xvEPA
United States
Environmental Protection
Agency
United States
Occupational Safety and
Health Actoinistratim.
EPA 550-R-98-005
June 1998
EPA/OSHA JOINT
CHEMICAL
ACCIDENT
INVESTIGATION
REPORT
Shell Chemical Company
Deer Park, Texas
EPA and OSHA
) Printed on recycled paper
-------
,',... in1!i' inijiii'iirf •, i!,,1 ill1.' nil,,,.•
-------
The EPA/OSHA Accident Investigation Program
EPA and OSHA work together under conditions detailed in a Memorandum of
Understanding (MOU) to investigate certain chemical accidents. The fundamental objective of '
the EPA/OSHA chemical accident investigation program is to determine and report to the public
the facts, conditions, circumstances, and causes or probable causes of any chemical accident that
results in a fatality, serious injury, substantial property damage, or serious off-site impact,
including a large scale evacuation of the general public. The ultimate goal of the accident
investigation is to determine the root causes in order to reduce the likelihood of recurrence,
minimize the consequences associated with accidental releases, and to make chemical production,
processing, handling, and storage safer. This report is a result of a joint EPA/OSHA investigation
to describe the accident, determine root causes and contributing factors, and identify findings and
recommendations.
In the EPA accident investigation report preparation process, companies mentioned in the
report are provided a draft of only the factual portions (no findings, conclusions or
recommendations) for their review for confidential business information. Federal agencies are
required by provisions of the Freedom of Information Act (FOIA), the Trade Secrets Act, and
Executive Order 12600 to protect confidential business information from public disclosure. As
part of this clearance process, companies often will provide additional factual information that
EPA considers arid evaluates for possible inclusion in the final report.
Chemical accidents investigated by EPA Headquarters are conducted by the Chemical
Accident Investigation Team (CAIT) located in the Chemical Emergency Preparedness and
Prevention Office (CEPPO) at 401 M Street SW, Washington, DC 20460, 202-260-8600. More
information about CEPPO and the CAIT may be found at the CEPPO Homepage on the Internet
at www.epa.gov/ceppo. Accidents investigated by the OSHA Headquarters are conducted by the
Chemical Accident Response Team (CART) located in the US Department of Labor - OSHA,
Directorate of Compliance Programs, Washington, DC, 20210, 202-219-8118. More information
about OSHA and the CART may be found at the OSHA Homepage on the Internet at
www.osha.gov.
U.S. Chemical Safety and Hazard Investigation Board (CSB)
In 1990, the U.S. Chemical Safety and Hazard Investigation Board (CSB) was created as
an independent board in the amendments to the Clean Air Act. Modeled after the National
Transportation Safety Board (NTSB), the CSB was directed by Congress to conduct
investigations and report on findings regarding the causes of any accidental chemical releases
resulting in a fatality, serious injury, or substantial property damages. In October 1997, Congress
authorized initial funding for the CSB. The CSB started its operations in January 1998 and.has
begun several chemical accident investigations.- More information about CSB may be found at the
CSB homepage on the Internet at "www.chemsafety.gov".
-------
For those joint investigations begun by EPA and OSHA prior to the initial funding of the
CSB? the agencies have committed to completing their ongoing investigations and issuing public
reports. Under their existing authorities, bom EPA and OSHA will continue to have roles and
responsibilities in responding to and investigating chemical accidents. The CSB, EPA, and OSHA
(as well as other agencies) are developing approaches for coordinating efforts to support accident
prevention programs and to minimize potential duplication of activities.
Basis of Decision to Investigate
An explosion and fire took place at the Shell Chemical Company Complex in Deer Park, Texas,
on June 22, 1997, resulting in injuries, public sheltering, closure of transportation routes, and
property damage both on and off site. EPA arid OSHA undertook an investigation of this
accident because of its severity, its effects on workers and the public, the desire to identify those
root causes arid contributing factors of the event that may have broad applicability to industry,
and the potential to clevelop recomriiendations and lessons learned to prevent future accidents of
this type. This investigation was conducted in conjunction with an investigation by OSHA to
determine if violations of occupational safety and health laws had occurred.
-------
Accident Investigation Report
" Shell Chemical Company, Deer Park, TX, June 22,1997
Executive Summary
On Sunday, June 22, 1997, at approximately 10:07 a.m. Central Daylight Time, a violent
explosion and large fire occurred at the Shell Chemical Company plant in Deer Park, Texas. The
explosion was felt and heard over ten miles away, and the ensuing fire burned for approximately
10 hours. As a result of the explosion and fire, extensive damage occurred to the facility, and
several workers received minor injuries. Nearby residential property was damaged. Major
transportation routes adjacent to the facility were closed for several hours, and nearby residents
were advised to remain indoors.
Under the terms of the EPA/OSHA Memorandum of Understanding for Chemical
Accident Investigations, a joint chemical accident investigation team (JCAIT) was formed to
investigate the accident and determine its root causes. A concurrent enforcement investigation
was done by OSHA to determine if any violations of occupational safety and health laws had
occurred. , .
The JCAIT determined that the immediate cause of the accident was the internal structural
failure and drive shaft blow-out of a 36-inch diameter pneumatically-assisted Clow Model GMZ
check (non-return) valve. The valve was located on a high-pressure light-hydrocarbon gas line
installed in the process gas compression (PGC) system of Olefins Plant Number III (OP-III). The
check valve's failure started a large flammable gas leak.. The escaping gas formed a vapor cloud
and eventually ignited, resulting in an unconfined vapor cloud explosion.
The JCAIT identified the following root causes of the accident:
• The Clow Model GMZ check valves installed in the OP-HI process gas compression
system were not appropriately designed and manufactured for the heavy-duty service they
were subject to in OP-UJ. This resulted in the valves being susceptible to shaft blow-out
during normal use,
• Lessons learned from prior incidents involving Clow Model GMZ check valves installed at
Shell facilities and at Saudi Petrochemical Company (a Saudi facility .partly owned by
Shell) were not adequately identified, shared, and implemented. This prevented
recognition and correction of the valve's design and manufacturing flaws at OP-UI prior
to the accident. .,
• The process hazards analysis (PHA) of the process gas compression system was
inadequate; the PHA did not identify the risks associated with shaft blow-out in Clow
Model GMZ check valves, and consequently no steps were taken to mitigate those risks.
in
-------
• Measures necessary to maintain the mechanical integrity of Clow Model GMZ check
valves installed, hi OP-III were not taken. This resulted in undetected damage 'to and
eventual failure of critical internal valve components.
• Operating procedures for the start-up of the PGC system did not specifically instruct
operators to re-verify the position of pneumatically-assisted check valves before restarting
the compressor following unexpected automatic compressor trips; consequently, operators
did not re-verify the position of the valve that failed. Re-verification might have enabled
operators to observe possible indications of the fifth stage suction check valve's imminent
failure on June 22, 1997.
The JCAIT identified the following factors that contributed to the accident:
• The lack of clear and immediate indications in the control room of a hydrocarbon leak
contributed to the severity of the accident by significantly delaying operator action to shut
down and depressurize the PGC system.
• Inadequate communications practices during the accident contributed to its severity by
hindering the timely flow of information to control room operators.
The JCAIT developed recommendations addressing the root and contributing causes to
prevent a recurrence or similar event at this and other facilities. While the scope of these
recommendations ranges from general to very specific, companies and industry groups not
specifically named should consider each recommendation in the context of their own
circumstances, and implement them as appropriate. The recommendations are summarized
below:
• Prior to restarting OP-IU, Shell Chemical Company should replace all Clow Model GMZ
check valves installed in the unit with valves not susceptible to shaft blow-out. Other
Shell facili^s and other companies as appropriate should review their process systems to
determine i|fhey have valves installed that may be subject to this hazard, and modify or
replace those valves as necessary to prevent shaft blow-out. Companies should consult
valve manufacturers or other appropriate design authorities to ensure any modifications
made are safe, [Editor's note: Prior to this report being published. Shell Chemical
Company replaced all Clow Model GMZ check valves installed in OP-III with valves not
susceptible to shaft blow-out]
•": ;/"i -! ' • '.' * V* .:..;•. .;>>:'''•:•'', ••' /, i> ': "•.'•,; ,• (•.'..,,•• •',..'•• >
• Shell Chemical Company should update and revalidate the process hazards analysis (PHA)
at OP-III and should consider updating and revalidating other units' PHAs to ensure all
operating and maintenance experience and incidents are fully evaluated. Shell should also
take appropriate measures to mitigate hazards identified by the revalidated PHAs.
• Shell Chemical Company should revise OP-IU PGC system operating procedures to
IV
-------
provide clear instructions for operators to re-verify the positions of pneumatically-assisted
check valves before the PGC is re-started following any compressor trip if said check
valves are at high risk of leakage or failure. Shell should also consider adding warnings or
caution statements in PGC system procedures related to the circumstances and indications
of check valve shaft blow-out, or other potential causes of hydrocarbon gas leaks.
Shell Chemical Company should improve their radio communications practices at OP-HI
and as appropriate at other facilities to ensure operational and emergency information is
^transmitted in an accurate and timely fashion. Other companies that require operators to
communicate in high-noise environments should also consider taking these or similar
measures.
Shell Chemical Company should implement a more rigorous mechanical integrity
inspection program for valves in extreme service or with a known history of failure where
the failure of such valves could result in catastrophic consequences.
Shell Chemical Company and Shell Oil Company should develop and implement a system
to ensure that lessons learned from all prior operating and maintenance accidents,
incidents, and near misses at Shell facilities (including facilities partly owned by Shell) are
always fully reviewed and incorporated as appropriate into the management and operation
of every Shell facility. •
Shell Chemical Company and other companies that process flammable gases: and volatile
flammable liquids or liquefied gases must implement precautionary measures contained in
OSHA's PSM standard and EPA's RMP rule to prevent flammable gas leaks from
resulting in vapor cloud explosions.
Atwood & Morrill Co., Inc. (the successor to Clow Corporation of Westmont, Illinois),
should inform all customers who have previously purchased Clow Model GMZ check
valves of the circumstances of this accident and of the potential for these valves to
undergo shaft blow-out.
Where feasible, companies should consider inherently safer design alternatives that limit
the potential for and consequences of worst-case accidents.
Chemical and petroleum industry trade associations should inform member companies of
the circumstances in the EPA/OSHA joint report of the Shell Deer Park accident. Trade
associations should also work together with individual member companies to develop and
institutionalize a stronger system for sharing and implementing lessons learned from
process incidents and accidents at companies in the United States and abroad.
EPA should take appropriate follow-up actions, such as inspections, audits, or
implementation of other policies to ensure that U.S. companies modify, remove,
or
v
-------
replace, as appropriate, all Clow Model GMZ check valves that are at high risk for shaft
blow-out
. .: : -tf..-"'A' '••':-•' -•:-.''<; ;,,^;v::i'x'',
EPA and OSHA should distribute this report and the Chemical Safety Alert entitled "Shaft
Blow-Out of Check and Butterfly Valves" to affected companies (including valve
manufacturers and users), industry trade associations, international organizations, Local
Emergency Planning Committees (LEPCs), and State Emergency Response Commissions
(SERCs). [Editor's note: Prior to publishing this report, EPA and OSHA distributed the
subject Alert to affected companies, trade associations, LEPCs, and SERCs, and posted
the Alert on the Internet at www.epa.gov/ceppo/. The Alert is also included as Appendix
F to this report.]
VI.
-------
s Table of Contents
Page
' ' -..--. - ''-..>
Facility Infonnation . . .. . ; . 1
Process Overview 2
Events Preceding the Accident 3
The Accident 5
Response to the Accident . ,9
The Investigation 10
Analyses 11
Exclusions 11
Methodology .....;..... ....'......., 12
Isolating the Source of the Flammable Gas Release 13
Eliminating Unlikely Leak Sources '...... 15
Metallurgical and Mechanical Findings and Analyses . . : .17
Analysis of Process Parameter Trends ................. 19
Vapor Cloud Explosion Modeling 20
Other Corroborating Evidence . . . .%. . 21
Ignition Sources 23
Immediate Cause of the Accident ; 23
Clow Model GMZ Check Valve Information ,'. ..24
. Previous Incidents Involving Clow Model GMZ Check Valves at Shell Facilities ....... 27
May, 1991 Clow Model GMZ Check Valve Malfunction at OP-III 27
December, 1991 Propane Gas Release in Saudi Arabia . . 28
1980 and 1994 Incidents at Shell Facility in Norco, Louisiana 29
Lessons Learned by Shell from Previous Check Valve Incidents . 29
' ' •'. /
Other Information .................. ^ 31
Shell Chemical Company Analysis of OP-III Process Hazards 31
-Operating Procedures 31
Root Causes and Contributing Factors ,. . . 32*
Root Causes 32
Contributing Factors .., :..,....... 36
vu
-------
Recommendations 38
References 42
List of JCAIT Members ."...,.'... . ............ .. . .... 43
" ' '' , i ' ' " '" ",' ' ' " : ' , :! 'll • ' , i,.1'" '''I"' '
'" iii ' ' "• ||;, ,' ' ' •, " ' i' • '' ' i. ' ,i '' '
' i " ' "ill . I' "' , .1 ' "'" ' !' ' ' ' ' , '.:" ' ' ' ' ,1 '
Appendices
A OP-III Layout ."..' 44
B Process Gas Compression System - Simplified Flow Diagram 45
C Events and Causal Factors Chart ....p 46
D Vapor Cloud Explosion Modeling 47
E Photographs of Accident Site and Damaged Components 55
; i " i ';';i ' • ,i," ' ' { j .! '/,; ',>.') •. ;_ ••..;. • ;.;... ' i •• ' : '\ .. ''
F Chemical Safety Alert: "Shaft Blow-Out of Check and Butterfly Valves" 69
List of Figures
Figure 1 . Geographic Area Surrounding Shell Complex 1
Figure 2 Clow Model GMZ Pneumatically-Assisted Check Valve 25
Figure 3 Expanded View of Check Valve Disk/Shaft/Key/Dowel Pin Arrangement 26
Figure D-l Peak Blast-Wave Overpressure on a Window for 50-Percent
Probability of Failure 54
Vlll
-------
Facility Information ,
The Shell Deer Park.Manufacturing Complex is a large multi-unit petroleum refining and
chemical manufacturing center located on the south side of the Houston Ship Channel
approximately 15 miles east of Houston, Texas. Shell occupies a 1400 acre plot in an area
predominated by chemical and petrochemical manufacturing, refining, and storage facilities.
The Shell complex is bordered by the Houston Ship Channel1 on the north, State Route 225, on
the south, and by other petrochemical company sites to the east and west. Beltway 8 (the
Houston'outer beltway) is located approximately Vz mile west of the complex. The nearest
residential communities are Channelview, Texas, located immediately across the Houston Ship
Channel to the -north, and Deer Park, Texas, located just south of Route 225 (see Figure 1).
About 2400 people are employed at the Shell complex. ,
Figure 1: Geographic Area Surrounding Shell Complex
The Houston Ship Channel provides a direct shipping route for oil tankers arriving from the Giilf of Mexico via
Galveston Bay. . ' .; ' .
'-'••"•'. 1 • . - •••••'
-------
Process Overview
The Shell Deer Park Manufacturing Complex is comprised of a chemical plant and an
adjacent oil refinery. The accident discussed herein took place in Olefins Plant Number III (OP-
III), one of several process units in the chemical plant. OP-III produces a variety of olefinic (i.e.
alkene-derived) petroleum intermediates by cracking and distilling assorted crude petroleum feed
stocks. Major products include ethylene, propylene, butadiene, and isoprene. These
petrochemicals are typically sold to other chemical companies who use them to synthesize a
variety of finished organic products. Other outputs from OP-III include gasoline, ethane, natural
gas", and other hydrocarbon derivatives. These products are either recycled, sent to other units for
subsequent processing, utilized for fuel in other Deer Park process units, or sold directly. OP-III
was constructed in 1976. A simplified plan-view layout of OP-III is included in Appendix A.
•',: ", \ ". ' „']< -, ' '' |..r ',;:>, ; v'1, •'';;''I,''/I' >'''':'V -,:[ '],••• . ;" ' ^'; •' J.
OP-III is roughly divided into two sequential process phases. The first phase or "hot side"
of the process involves the thermal cracking of large-molecule hydrocarbon feeds into smaller
molecules by mixing the crude petroleum feeds with steam in a series of high-temperature (1500
degrees F) pyrolysis furnaces. The cracked hydrocarbon molecules are then separated by boiling
point (fractionated) in a large vessel at elevated temperature, where heavy oils and pitch are
processed and removed. The second phase or "cold side" of OP-III involves compression and
treatment of lighter hydrocarbon gases and separation of light hydrocarbon molecules by low
temperature fractionation of condensed light hydrocarbons.
While the accident affected equipment and systems on both sides of the unit, the primary
system involved was the process gas compression system, and investigators focused on its design
and operation in determining the cause of the accident. The process gas compression system is the
first process system in the cold side of OP-III. The major component in the system is the process
gas compressor (PGC), which receives light hydrocarbon gases from the top of the pyrolysis
fractionator and compresses the gases, condensing them to liquid for treatment and subsequent
molecular separation. The PGC is a five-stage steam turbine-driven centrifugal compressor.
Each compression stage has a suction drum and the final two stages have discharge drums, which
are used to separate and remove condensed liquids from process gases. Condensed liquids are
collected at the bottom of each suction and discharge'drum and transferred to subsequent process
Steps or storage. Large-diameter, pneumatically-assisted swing check valves are located on the
suction side of the third and fifth compressor stages and On the discharge side of the fourth and
fifth compressor stages. During normal system operation, these check valves remain open to
allow forward process gas flow. However, they automatically close in order to prevent PGC
damage whenever reverse gas flow occurs. A simplified one-line schematic of the PGC system is
shown in Appendix B.
-------
Events Preceding the Accident .
At approximately 2:15 a.m.2 on Sunday, June 22, 1997, OP-III was operating at full
production capacity under normal conditions. Shortly thereafter, all incoming electrical power to
the unit was lost when a current transformer on the incoming electrical supply bus exploded,
probably due to the effects of lightning from an electrical storm which passed through the area a
short while earlier. OP-III receives AC power from two separate offsite sources, but the affected
transformer was located on an electrical circuit which ties those sources together, and its failure
resulted in the temporary loss of both incoming power sources. The total loss of incoming AC
power resulted in the loss of power to vital electrical loads and necessitated the almost complete
shutdown of OP-HI production processes and equipment, including the PGC. The shutdown of
the PGC caused its associated pneumatically-assisted check valves to rapidly shut, as designed to
prevent reverse gas flow through the machine.
, .Some vital electrical loads which de-energized during the power outage were immediately
restored by .electricity supplied from emergency generating equipment, and some other equipment,
such as the fractionator and fractionation furnaces, which do not require electrical power, were
not immediately affected by the electrical outage, and continued to operate. OP-III hot-side and
cold-side foremen3 conferred and decided to shut down most major equipment that was still
operating, such as all compressors and several furnaces, but to keep some equipment operating,
including several furnaces, the fractionator, and some other support and auxiliary equipment, in
order to be ready to restart the PGC and remaining OP-III unit processes when off-site electrical .
power was restored.
In anticipation of quickly restoring full electrical power, foremen called in additional
operators to assist with plant startup. 'At approximately 5:00 a.m., half of off-site AC power was
restored, and additional operators were present, so the OP-in cold-side foreman (hereinafter
referred to simply as "foreman") began to direct prerequisite operations for PGC startup. Even
though full electrical power had not yet been restored, the foreman stated that he felt some
urgency to get the PGC restarted as soon as possible because as long as the PGC was shut down
while some furnaces and the pyrolysis fractionator were operating, uncompressed process gases
from the fractionator had to be burned off in the flare. Further, the loss of electrical power had,
caused the shutdown of steam generators which produce dilution steam for the flare.
Consequently, a high flame and large amounts of smoke were emanating from the flare stack as
the uncompressed process gas was combusted without dilution steam. This condition was
considered undesirable, since it wasted resources (i.e. process gas) and also produced an unsightly
smoke cloud over the facility. The foreman knew that starting the PGC would help eliminate this
2 ' ...
All times in this report are based on the 12-hour clock and are local (i.e. Central Daylight) times.
OP m has two foremen (also called team leaders), each of which are responsible for supervising and coordinating
operations in one of two major sections of the plant The "hot-side" foreman supervises operation of the pyrolysis furnaces, the
pyrolysis fractionator, and associated hot-side support equipment, and the "cold-side" foremajLsupervises operation of plant
components downstream of the pyrolysis fractionator, including, among others, the Process Gas Compression system.
-------
; i,, - • >:n v < ' : • : -v : i . i •.
problem, since process gas would no longer need to be routed to the flare.
::"': ,' • . ' ' :'',J . , '•'•' ' '' • '•• : •': '= ' ;''V'• '"• •• '', ) ••' '• ',' • •''.
Jil' , „ , ,, -1!1',; . » ;" "• ,!! .', • ' ,; • !; , ., .1; I , '.i , ' ' , ih , „
At approximately 5:30 a.m., the foreman directed the PGC field operator 4 to place the
PGC on "slow roll." "Slow roll" refers to a pre-startup condition where the PGC is rotated at
low rpm in order to warm up its steam turbine and to prevent its rotor from bowing under its own
static weight. The PGC is normally slow-rolled for at least two hours and usually four hours prior
to being started. To protect the machine from damage, the PGC turbine has vibration sensors
which automatically shut down the machine if excessive vibration is detected. According to
various operator statements, between 5:30 a.m. and 8:45 a.m., the PGC tripped (i.e. automatically
shut down) at least three times, and possibly as many as five times, due to high turbine vibration
while on slow roll. Operators placed the machine back on slow roll after each trip. Again, each
PGC trip also resulted in the automatic actuation of the pneumatic cylinders on the four
pneumatically-assisted check valves located between compressor stages, shutting the valves.
At approximately 8:45 am, the foreman consulted with plant electricians who indicated
that full electrical power would still not be available for several hours, but that sufficient electrical
power was currently available to support PGC start-up. The foreman therefore decided to start
the PGC as soon as possible, but using backup electrically-powered PGC lubricating oil and seal
oil pumps instead of using the normal steam-driven oil pumps. Also, since only five pyrolysis
furnaces were operating to provide load to the compressor, and the PGC is normally loaded
during start up from at least 6 furnaces simultaneously, the cold side foreman directed a sixth
furnace to be started using natural gas and stationed an additional operator to feed natural gas
from the sixth furnace directly to the inlet of the PGC first stage in order to provide additional
compressor load as needed. The foreman briefed his start-up crew regarding his intentions. The
PG-C field operator expressed some concern about starting the PGC without full electrical power,
but agreed that the startup was feasible under existing conditions.
Operators finished pre-startup checks5 and commenced the PGC startup sequence at
approximately 9:30 a.m. The PGC field operator started the PGC and began to raise its speed.
As PGC rotational speed reached approximately 1500 rpm, the PGC automatically tripped due to
high vibration. Once again, this caused the pneumatically-assisted check valves to slam shut.
Operators concluded that the PGC trip was caused simply by their failure to raise the
During startup, a field operator controls the PGC from a control panel located outside on an elevated deck above the
machine; after the machine is running and the system is stable, PGC control is transferred to an operator in the control room. -
The cold-side foreman stated that he neglected to perform one step of the pre-startup sequence involving
prcssurization and draining of condensate from PGC system low points and from steam turbine drains. This step is done in
order to prevent liquid from entering either the compressor or the turbine, which could cause excessive vibration to the
machine. The failure to perform this pre-startup step may account for the higher than normal turbine vibration observed during
startup.
-------
speed of the compressor quickly enough through its critical speed range6, so the foreman decided
to immediately restart the PGC. Since very little time had passed since the initial PGC trip, and
believing he knew the cause of the trip, the foreman did not order any more pre-startup checks to
be performed prior to the second PGC startup attempt. According to operators, during the
second start up, PGC vibration was again higher than normal7, and a vibration alarm occurred as
PGC rotational speed passed into the critical range, but the alarm cleared as soon as speed was
above the critical range, and no automatic trip occurred. By 10:00 a.m. PGC system operation
appeared to be normal, and the PGC field operator was preparing to switch control of the PGC to
the control room.
The Accident
From approximately 10:03 a.m.8 until shortly after 10:07 a.m., the following sequence of
events occurred (locations referred to in the following narrative are illustrated in Appendix A):
Approximately 10:03 a.m.:
• Personnel working outside in OP-III hear, a loud "pop" followed by the extremely loud
noise of a continuous high-pressure gas release. One person later describes the noise as a
"jet engine sound."
• The foreman exits the OP-IE control room and is heading toward the PGC operating deck
when he hears the gas release. He contacts operators in the control room by radio and
asks if they see any unusual indications on their control panels. The control room
operators respond that they do not see any unusual indications (data records later revealed
that PGC fifth stage flow had begun a gradual decrease and that PGC fourth stage flow
. increased momentarily, and then began dropping, but these changes represented a small
percentage of overall PGC flow, and were not immediately detected by operators).
• The PGC field operator, who is stationed outside at the PGC deck preparing to transfer
PGC control to the control room, hears the release - it is very loud and sounds to him like
a 1250 psig steam relief valve opening under pressure.
• Other personnel working in the vicinity all hear a sudden loud, continuous roar. These
personnel include another field operator, a trainee, and two contractor instrument
For rotating machinery, "critical speed" refers to a range of rotational speed around the fundamental or a harmonic
resonant vibration frequency of the machine's structure. Lengthy operation hi this speed range is undesirable because it
produces excessive vibration and can result hi damage to the*machine.
The cold-side foreman indicated that turbine vibration was about five times higher than normal (1 mil vice 0.2 mils).
8 - " ' '
Tunes in the accident sequence description are referenced to the internal clock of the OP-m Operational Data
Seryer. ' , ' ., . • , •
-------
technicians working in the north yard.
111 "• " "'''!; ''' '• " "' ' '.•' •:"•'•,'' : '••'.'
Approximately 10:03-10:05 a.m.
•I!1,;* • • • • " • ' " ' ' " ' '' " '" , ' , ' * , i " '
The foreman radios to the control room and informs operators that there has been a gas
release and to activate the unit evacuation alarm. He then gets on his bicycle, and
proceeds west along N. 22nd Street, toward the fractionator, and in the general direction
of the noise to identify its source.
Control room operators have difficulty understanding the foreman's radio transmission -
his voice is loud and excited and the sound of the gas release in the background masks
part of the transmission. One operator hears "there's a leak in the pipe rack!"; another
hears '^there's a release, there's a release!"; a third operator believes he hears "Fire on the
PGG!" The control room operators activate the unit evacuation alarm lights9, radio for
field operators to come in from the field to safe shelters, and call the guard at the main
gate to inform him of the release and to put the fire brigade on stand-by.
Five persons in the control room, including the fractionator operator and a furnace
operator, don bunker gear (fire protective clothing) in order to exit the control room to
respond to the gas release and what they believe to possibly be an ongoing fire. The
fractionator operator exits first, by the west door, and hears the sound of the gas release.
He judges that the release sounds very different than a fire, so he immediately re-enters the
control room and informs remaining operators that there is no fire. Then he leaves the
control room again and heads west down the pipe alley, toward the noise. The furnace
operator and three other operators wearing bunker gear also exit the control room. The
furnace operator follows the fractionator operator down the pipe alley, while the three
other operators head west down N. 24th Street, looking for any sign of smoke or fire.
The PGC fiejd operator, located on the PGC deck, hears the report of the release on the
radio. He looks west, towards the source of the noise, but cannot see anything unusual.
Looking east, he sees several operators exit the control room and move west, wearing
bunker gear. He remains at his station.
A machinist supervisor and auxiliary field operator heading North past electrical Substation
110 on a golf cart suddenly hear a lot of rapid, excited radio transmissions. Stopping the
golf cart to listen, they hear the report on the radio: "There's a release, there's a release!",
but do not hear or see any gas release. The pair decide to return to the control room,
where the machinist supervisor drops off the auxiliary field operator. The auxiliary field
operator runs into the control room and informs control room operators that there is a
Control room operators actuated the unit evacuation alarm, but not the plant evacuation alarm. Activating the unit
evacuation alarm turns on a set of alarm lights throughout OP-HI only, but does not activate the overall plant evacuation alarm.
The plant evacuation alarm, on the other hand, actuates an audible signal which can be heard throughout the Deer Park
Complex. Most OP-IE personnel located outside during the accident stated that they did not hear or see any alarm signal.
-------
"leak in the pipe rack." •
Other personnel working outside begin to evacuate the area and head for the nearest
shelter.
Approximately 10:05-10:07 a.m.:
The foreman passes south of the fractionator and turns north into the South Yard pipe
alley. Looking east down the pipe alley, the foreman observes what he later described as a
"colorless vapor" originating near the PGC fourth and fifth stage discharge drums and
blowing north to south across the pipe alley. He approaches even closer and stops in the
pipe alley, just south of the fourth and fifth stage discharge drums and sees a vapor cloud
approximately 15 feet high and-which appears as a "breeze with hydrocarbon eddies". He
also smells a "sweet, light hydrocarbon smell", and realizes that the leak is probably
flammable process gas. He radios the control room again and orders control room
operators to "Shut down the PGC and dump everything to the flare!" - he repeats the
order three times, but receives no reply.
The machinist supervisor, after dropping off the auxiliary field operator at the control
room, continues on his golf cart south along W. 35th Street toward the furnace area to
notify maintenance personnel working on furnace F-1040 to leave the area and head for
shelter. As he proceeds south, he looks west down N. 24th Street and sees what appear
, to be "heat waves" flowing to the north from the vicinity of the PGC fourth and fifth stage
drums.
The operator and trainee from the North Yard ride their golf cart east down the pipe alley
and enter the control room. Meanwhile, the contractor instrument technicians ride
bicycles east down N. 24th Street toward the control room. As they pass the PGC fifth
stage drums, they see a "golden-yellow" vapor cloud billowing over the drums and note
that the noise of the release seems to originate somewhere between the drums and the
overhead cooling fans. They reach the control room as the operators wearing bunker gear
are coming out.
The fractionator operator heads west down the pipe alley and sees what he believes to be
steam blowing from north to south across the alley. He also sees a safety shower sign,
' suspended below the pipe rack opposite the fractionator, "whipping" back and forth.
From this, he judges that the release is coming from the vicinity of the PGC fourth or fifth
stage drums. Still thinking the leak is steam, he continues to move west along the north
side of me alley, closer to the release, followed by the furnace operator.
Approximately 10:07 a.m.:
The vapor cloud formed by the gas release has now been generating for approximately 4
-------
minutes. It finally reaches an ignition source, causing the vapor to ignite and explode,
sending a blast wave in all directions. As the blast wave moves outward from its origin, it
damages ariddestroys equipment and[structures, rips insulation and flashing away from
piping, breaks windows, blows down doors, and knocks nearby personnel off their feet
and through the air.
• As he sees and smells the vapor, the foreman realizes he is in serious danger from a
potential explosion, and decides to leave the area. He reverses direction (turns towards
the, west) ands begins to ride back down the pipe alley. As he turns south to exit the pipe
alley near the dilution steam generators, the explosion occurs. He sees a flash of light out
of his peripheral vision and is thrown off his bike and through me air for several feet
before landing in an open area adjacent to the dilution steam generators. He receives no
serious injuries, but remains on the ground for a short while, disoriented.
f, ; _ i,1 ' ' ' "ij ' i.,1" - ' " ; •;• ',..; id ,.••••; " , , • ',:. \> [:• ";' .•.•' .,''' ' ' • -
• In the control room, operators have trouble hearing the cold-side foreman's latest radio
transmission, but believe they hear him order, "Shut down the PGC and dump (garbled) to
the flare". After a short discussion with other control room operators, the PGC board
operator pushes the PGC shutdown button andbegins to open the fifth stage flare valve
(which begins to depressurize the PGC system). He gets the valve partially open when the
explosion occurs.
." J . . " •, :'•, '•;• v '/Mr ;•::'i ' •• s .. •';• ; •",,;.. . .
• The fractionator operator and furnace operator continue to move west down the pipe alley
until they approach to within about 70 feet of the source of the gas leak. They now see
the vapor cloud, which appears as 'Vaves of white vapor" originating just north of the
pipe rack about 8 to 12 feet above the ground, and moving north to south across the pipe
alley. The fractionator operator also detects a "light, sweet hydrocarbon" smell, and
realizes that the leak is flammable hydrocarbon process gas and not steam. The operators
now realize their danger and'decide to leave the area. As they turn to leave, the explosion
occurs. The fractionator operator hears a "whump", and sees a "wall of air" moving
toward him, scattering debris and peeling insulation from pipes as it approaches. The blast
tears portions of the fractionator operator's bunker gear off of his body and throws both
operators several yards east clown the pipe alley. In spite of the force of the blast and then-
proximity to the explosion, they escape without serious injuries.
• " The PGC field operator, still located outside on the elevated PGC deck, finally decides to
seek shelter; he takes two steps toward the stairs when the explosion occurs. The blast
knocks him off of his feet onto the grating, but he is not seriously injured10.
;' ' , ,; ' •", • ."•! .,',•• • • :,- " /"'V ..• V,";1'!''1,- . '• ••••;.' ' .i1,!1 ••' • :.:<' ' '-, • ; "
* The three other operators in bunker gear are near the PGC fourth stage suction drum and
Shortly after the blast, the PGC field operator began to experience severe chest pains and shortness of breath.
Fearing a heart attack, first responders sent him by ambulance to a nearby hospital for treatment. His symptoms were later
diagnosed as asthma-related, and he was released.
-------
looking towards the PGC fifth stage drums when the explosion occurs. They see a bright
flash of light coming from the pipe rack in the vicinity of the PGC fifth stage drums. The
blast throws the three operators backwards and to the ground. The operator furthest from
the blast sees flames pass directly above the other two operators, but none of the three are
seriously injured.
After the Explosion:
The explosion starts a major fire, which is initially fed by the flammable gases still escaping
through the original leak, and subsequently from other hydrocarbon lines which rupture
when exposed to the intense heat of the blaze. The heat is so intense that it melts steel
structural beams, and one entire section of the overhead cooling fans and supporting
structure eventually collapses. The fire burns for about 10 hours.
The PGC field operator, foreman, fractionator operator, furnace operator, and the three
operators in the north yard pick themselves up and move tbward the control room. The
foreman, fractionator operator, and three north yard operators turn on fire monitors (fixed
water turrets used for fighting fires) as they go by and aim them toward the flames.
In the control room, operators completely depressurize the PGC system and dump its
contents to the flare. Organized emergency response begins. A count of personnel is -
started, and some personnel leave to search for those who were outside during the
explosion. Within minutes of the explosion, everyone is accounted for - the foreman is the
last person to reach shelter. Several people have received minor injuries and are later
treated at a local hospital, but no one is seriously injured or killed.
Response to the Accident
11
At the sound of the explosion, the Shell Deer Park fire crew was activated and, along with
OP-III operators already on scene, immediately responded to the fire. The Deer Park Complex
has a dedicated fire water system which extends throughout the site, including OP-in, and
operators outside during the accident activated and positioned fire monitors towards the blaze.
Shell emergency responders were also able to position a pickup truck-mounted fire monitor to
within feet of the center of the fire. Responders drove the portable monitor down the pipe alley
from the east directly under the burning pipe rack, positioned the water cannon towards the worst
part of the blaze, and abandoned the truck in place to the east of the fire with the water cannon
activated. Later inspection of burn patterns and debris indicated that this single act was probably
responsible for substantially mitigating the spread of the fire in that direction. The truck itself,
although very near the worst part of the blaze, was protected by the water being continuously
sprayed from its portable fire monitor, and suffered relatively little damage. A second truck-
The scope of this EPA/OSHA joint chemical accident investigation did not include a critical analysis of the
emergency response to the accident. • .
-------
mounted monitor was positioned to the south of the fire, but responders were not able to place it
as close to the fire as the first, and therefore it was somewhat less effective.
Shortly after the explosion, the Shell incident commander contacted the local police
department and requested that State Route 225 and Route 8 be closed to traffic passing near the
Shell Complex. Police complied with this request and closed sections of these roads adjacent to
the; complex to non-emergency traffic for approximately three hours. The incident commander
also contacted local community emergency planning organizations, including the Deer Park Local
Emergency Planning Committee (LEPC) to inform them of the incident Nearby residents were
advised to remain indoors during the incident. Shell officials stated that these measures were
precautions taken in order to protect the public against any secondary explosions or potential
toxic effects of the heavy smoke being generated by the fire, and to allow easier access to
emergency vehicles on public roadways.
The smoke plume from the fire migrated towards the northwest, across the Houston Ship
Channel and over the community of Channelview, Texas. Shell technicians obtained air samples
y:!1,! ' i ; ' „ iiv.iw • : • "T. . . „ ,, . in . ..I-,,,!, r,, „• , ' ,i •*•
in pie path of the smoke plume using both automatic in-place samplers and by manual grab sample
methods. Each sample was analyzed for harmful constituents, including benzene, asbestos, and
other toxicants. Concentrations of all contaminants were found to be below federal and state
„, , r'.ji1! ' ' N' ' ,! ' , ;l, '„ ;::'; . / .„ ',.-'.; -, '; „ \ . \,' ' '
regulatory limits.
*,! i"1 ' i " '"' ,' i1'',,",'' ' ', •' i : °'' '
'i ','iiii ' ' , '' ", i' ''
Shell also requested and received emergency response support from the Channel
Industries Mutual Aid, (CEMA) organization. CIMA is an emergency response organization
formed through the joint membership of the industrial companies located along the Houston Ship
Channel. CIMA is organized such that all member companies agree to respond to major accidents
at any other member company's site with designated emergency response resources. Emergency
response personnel and equipment from CIMA member companies were integrated into Shell's
response unit using the Incident Command System.
Transportation routes were re-opened to public traffic at approximately 1:00 p.m., and the
fire was extinguished at approximately 8:00 p.m.
Photographs depicting the damage resulting from the accident are shown in Appendix E
(figures E-l through E-8).
The Investigation
'!•. ' •'. ^ 1 V , •' •.•' •;,''. '•'••; •. • i;1':, \ , , '••• .•••/' •[ ,"_ :; • •'
OSHA investigators from the OSHA Houston South Area Office and an On-Scene
'111,' ! ' "i ' „' ' ' If'Ml „• ' , i r, , „ ,,,•»! n .,•','!, " 'i
Coordinator from EJPA Region 6 arrived at the scene on the day of the accident and were joined
by additional EPA and OSHA investigators on Tuesday, June 24. After inspecting the accident
scene and conducting preliminary interviews, EPA and OSHA investigators decided to conduct a
joint root cause investigation and convened a Joint Chemical Accident Investigation Team
(J
-------
workers and the public, the fact that its causes were unknown, and the potential to gain important
knowledge and lessons-learned to prevent further accidents of its type. The JCAIT consisted of
members from EPA headquarters, OSHA Headquarters, EPA Region 6, and OSHA Region 6
(Houston South Area Office, Corpus Christi Area Office, and Little Rock, Arkansas, Area
Office). Members of the Oil, Chemical, and Atomic Workers Union (OCAW) who were also
workers at the Shell Deer Park Manufacturing Complex participated with the JCAIT as observers
in the on-site fact-finding portion of the investigation. The JCAIT also employed independent
expert consultants for laboratory testing and other specific investigation activities.
Shell Chemical Company also initiated an Accident Investigation Team (AIT). The Shell
AIT and EPA/OSHA JCAIT cooperated in the fact-finding portion of the investigation which
included collection and documentation of physical evidence, and agreed to joint access to all
physical evidence for testing purposes. The two teams conducted separate witness interviews.
The Shell AIT team prepared its own internal investigation report, which reached similar
conclusions to this report regarding the immediate cause of the accident.
In the course of the investigation, investigators conducted numerous witness interviews,
collected documentary, photographic, and physical evidence, and performed laboratory analysis of
equipment and piping samples. Investigators also obtained and analyzed computer data records
from the OP-III Operational Data Server (ODS), a system which automatically records and
electronically stores system parameter readings for later retrieval.
The investigation was conducted roughly in two phases. In the first phase of the
investigation, investigators from EPA, OSHA, and Shell collected physical evidence and
conducted analyses in order to, determine the immediate cause of the accident. This information is.
primarily contained in the following section of this report (Analyses). In the second phase of the
investigation, the EPA/OSHA JCAIT evaluated Shell and OP-HI safety management systems and
human performance factors in order to determine the underlying root and contributing causes of
the accident and to make recommendations to prevent recurrence of similar incidents.. This
information is contained in the subsequent sections of this report.
Analyses
Exclusions
The JCAIT excluded the following factors as being contributory to this accident:
• . Sabotage: The JCAIT found no evidence of sabotage or intentional wrongdoing related to
this accident. Agents from the Bureau of Alcohol, Tobacco, and Firearms'questioned
employees regarding the circumstances of the accident, and also found no evidence, of „.
sabotage. •
• Health: The JCAIT concluded that health and fatigue of personnel was not a factor in this
s . • . , ' T •
11
-------
accident. The JCAJ.T did not collect toxicological specimens from witnesses in order to
test for illicit drug or alcohol impairment, but witness testimony provided no evidence of
drug, alcohol, or fatigue-related impairment in tibe events leading up to the accident.
Therefore, the JCAIT concluded that drugs, alcohol, and fatigue were not a factor in this
accident.
.1
• Weather, natural phenomena, or "Acts of God": At the time of the explosion, the weather
was overcast and warm, with a light breeze from the southeast. Although lightning
probably caused the power outage that occurred on the morning of the accident, the
JCAIT did not conclude that this was a significant factor in the accident. In the opinion of
the JCAIT, the power outage simply forced the subsequent plant startup, a relatively
routine evolution. This accident coujd just as likely have occurred during any plant
startup, whether or not it was preceded by a power outage, and possibly even during
normal operating (i.e. non-startup) conditions. No evidence was foundI to suggest that
other natural phenomena or Acts of God such as earthquakes, tornadoes, etc., contributed
to the accident.
Methodology • ,
Possible types of explosions include chemical and nuclear explosions, vessel over
pressurization, boiling liquid expanding vapor explosions (BLEVEs), and vapor cloud explosions.
Based on early eyewitness statements and visual inspection of the damage, investigators made a
preliminary judgement that a vapor cloud explosion had occurred as a result of the ignition of a
flammable gas cloud. The clear indications of a large flammable gas release immediately
preceding the explosion, the fact that the area of the explosion and fire was highly congested (i.e.
numerous vertical and horizontal structures extended throughout the volume affected by the
explosion), along with a relative lack of missile debris or fragments (which would normally result
from a vessel explosion) suggested a vapor cloud explosion.
Guidelines for Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires,
and BLEVEs (Center for Chemical Process Safety of the American Institute of Chemical
Engineers, 1994), specifies that several factors must be present in order for a vapor cloud
explosion to occur. These include:
1. The release of a large quantity of flammable gas or vaporizing liquid from a storage
tank, vessel, or pipeline. The released material must be at suitable conditions of pressure
and temperature for ignition to occur in the presence of an ignition source.
•' i'VI '. ', ' .' '" '.'• ••'•'• .'••."/•V '' : -/ 'V'f ' '' 'V' ''.. >' ' '" '•.'••'',
2. The formation of a cloud of sufficient size prior to ignition.
1 ' ' i "is* ' ' ' '• "" ' '' „ ' '• ,', ' '
J i'3i " ' , '", ' ' ' ,;, '"' - i '• / j-' ,' " ' .i':! .'..'' :': • :'', •.:, '. ' ' . ' , "
3. A significant amount of the vapor cloud must be within the flammable range of the
material in order to cause significant over pressure upon ignition.
12
-------
4. The presence of turbulence in the released vapor. This produces the high flame
propagation speeds necessary to produce significant overpressure, and normally results
from either turbulence associated with the release itself (e.g. a jet release), turbulence
produced by gas expansion through a congested space, or by externally induced
turbulence (e.g. from objects such as ventilation systems).
1 '.-.'.' < , ,
5. The presence of an ignition source.
Investigators determined that large quantities of flammable material were contained in OP-
III process equipment, systems, and piping prior to the explosion, and that if released in sufficient
quantity and ignited, all other conditions necessary for a vapor cloud explosion were likely
present. Investigators therefore focused on identifying the source and immediate cause(s) of the
postulated flammable gas release, and the presence of suitable ignition sources.
Isolating the Source of the Flammable Gas Release
To determine the location and source of flammable gas released prior to the explosion,
investigators first interviewed eyewitnesses to the gas release and explosion, reviewed data
recordings, and collected physical evidence in and around the area of the blast. Using this
information, investigators sought to narrow the range of possible leak sources for further
investigation. Key evidence and significant facts identified by investigators as pertinent to
determining the source and immediate cause(s) of the gas release and explosion, included the
following: - . '
• Witnesses described the sound of the initial gas release as loud, sudden, and continuous,
without any detectable buildup.
• Virtually every' eyewitness account placed the source of the initial gas release in or near
the north side of the pipe rack, in the approximate area of the PGC fifth stage drums.
• Several eyewitnesses described the odor of the escaping gas as "light and sweet".
• Eyewitness accounts of the color of the vapor cloud ranged from "colorless" to "white" to
"golden-yellow".
• Wind direction at the time of the explosion was from SE to NW at approximately 9 miles
per hour.
• Eyewitnesses located in or south of the pipe alley all stated that vapor observed in the pipe
alley traveled from north to south (against the general wind direction). Eyewitnesses
located north of the pipe alley observed a vapor cloud drifting towards the north (with the
general wind direction).
13
-------
Witnesses stated that they heard only one explosion.
Eyewitness estimates of the length of time between the start of the gas release and the
explosion varied significantly. One eyewitness (the PGC field operator) estimated that the
gap was only about 1 minute. Another witness (the auxiliary operator) estimated that the
gap was approximately 10 minutes. Most other eyewitness estimates varied from as short
as 2 minutejto as long as 7 minutes from the start of the release until the explosion.
Analysis of process parameter trends recorded by the Operational Data Server (ODS)
indicated that the leak started approximately 4 minutes before the explosion occurred (see
pages 19-20 for a detailed explanation of this analysis).
A plant security video camera monitoring the southern end of OP-III recorded the blast
wave produced by the explosion and its effects. The time mark on the video camera
indicated that the explosion occurred at 10:04:57 a.m. The security camera's clock was
found to lag the ODS clock by approximately 2 minutes.
Hydrocarbon leak detectors were not installed in OP-III, and no other means of
automatically detecting the presence, source, or location of a flammable gas leak were
present.
The greatest explosion, fire, and heat damage occurred within approximately 200 feet of a
point roughly 50 feet north of the fractionator and extended upward throughout the pipe
rack. Steel structural members had warped and failed from the heat, piping had ruptured
and fractured, electrical power and instrumentation cables had been incinerated, and other
machinery, equipment, piping insulation, and electrical controls had been burned. One
long horizontal section of overhead metal structure which supported the cooling fans (fin-
fans) over the pipe rack had collapsed on top of the pipe rack, causing additional damage
to* components below (see Appendix E, figures E-l through E-4).
Among the explosion and fire damage, investigators identified and catalogued 52 openings
in damaged pressure components and piping systems, each of which was considered as a
potential source of the initial gas release.
jjiUI] , ..„ ";'.,_ ,: i % , •••; .;•..;. '• • ;" " • h ' " . '
One of the 52 openings was in a 36-inch diameter Clow Model GMZ pneumatically
assisted check valve located on the PGC fifth stage suction line; this valve was found to be
missing its drive shaft and counterweight assembly. The hole in the valve created by the
absence of the drive shaft was located 9 feet above grade, orientated directly south, and
was 3.75 inches in diameter. The valve flapper was found stuck in a partially closed
position, and a square bar-type metal drive shaft key was found lying loose inside the valve
body. The valve was otherwise intact and relatively undamaged (investigators later
conducted detailed metallurgical analysis on this valve and four other piping sections - see
page 17, Metallurgical and Mechanical Findings and Analysis).
14
-------
• The drive shaft and counterweight assembly from a 36-inch pneumatically assisted check
valve were found located on the ground 42 feet directly south of the check valve.which
was missing these components, in an essentially unobstructed line of travel from the valve.
The components were found lying directly on the cement ground surface (i.e. with
virtually no debris beneath them), but beneath several inches of petroleum residue, tar, and
other debris resulting from the explosion, fire, and firefighting efforts.
Eliminating Unlikely Leak Sources •
4
While investigators judged that most of the 52 system openings or penetrations found
among the wreckage were a secondary result of the explosion and ensuing fire, each were
considered as possible candidates for the initial leak source. These 52 openings were screened
against other evidence in order to eliminate impossible or unlikely alternatives and eventually
narrow the list to a small number of openings, or perhaps a single opening which could have
produced the flammable vapor cloud. The screening process, or process of elimination, compared
each opening against the following set of criteria based upon eyewitness accounts, physical
principles, metallurgical,analysis, recorded data trends, and other factors:
• The opening must have been in a system which carried flammable gas or a flammable
vaporizing liquid under pressure.
• The opening must have been in a system which carried "sweet" hydrocarbon (i.e. which
did not contain "sour" or acid gas)12.
• The opening must have been sufficiently large to release enough vapor over an
approximate four minute time span to account for the observed explosion.
• The opening must have been in the approximate location identified by eyewitness accounts
of the leak source (i.e. in or near the north side of the pipe rack in the vicinity of the PGC
fifth stage drums). _ '
• The original orientation of the opening must have conformed with eyewitness accounts of
' vapor cloud formation and dispersion, as well as the observed effects of the explosion.
• The physical condition of the opening must corroborate other eyewitness accounts and
physical evidence. Numerous eyewitness accounts indicated that the gas release was
sudden (i,e. there was no buildup) and constant, and that no fire occurred prior to the
explosion. Therefore, metallurgical analysis of the component responsible for the initial
\r) ' • •
Depending on the source of crude oil used as a source material, cracked hydrocarbon gas contains varying amounts
of acidic gases, such as hydrogen sulfide. When present, these acidic components give the cracked hydrocarbon gas a
distinctive noxious smell which operators commonly describe as "sour". In OP-HI, the acid gases are "scrubbed out", or
eliminated from the lighter hydrocarbon gas between the fourth and fifth compression stages, and the resulting gas is described
as "sweet" because it no longer contains the noxious odors of the acid gases.
:' 15 .
-------
leak should indicate that the component had experienced a sudden, brittle failure, rather
than a ductile rupture produced by extreme heating.
* , The subject opening must account for the unusual process parameter trends recorded
between the tune of the release and the time of the explosion.
Investigators eliminated over 90% of the 52 possible openings from consideration as the
likely leak source by using just the first five of the constraints listed above. This resulted in the
following analysis:
. ' ' " • " ;>,.'' •' '. ' •' >'.\ ' '•'• : •'" '..' " • ' : '' ; , V ,? ' '' , ' , '
• 18 openings were eliminated from consideration as the primary release source because
their respective systems did not contain flammable materials (e.g. they carried steam,
water, air, or some other non-flammable material);
• 10 openings were eliminated because their respective systems contained heavy oil
mixtures, pitch, or other low-volatility hydrocarbon mixtures of insufficient volatility to
vaporize and explode;
• 9 openings were eliminated because they were not large enough (in relation to system
pressure) to release sufficient hydrocarbon materials within a 4 minute period to generate
a vapor cloud large enough to cause the observed explosion;
• 2 openings were eliminated because they carried sour gas (such as hydrogen sulfide) - and
eyewitness accounts clearly indicated that the vapor cloud smelled "sweet";
• 8 openings were considered unlikely to have caused the release because they were
originally orientated in the wrong direction to account for eyewitness observations of
vapor cloud formation and dispersion.
This analysis eliminated 47 of 52 openings as likely sources for the gas release13.
Investigators focused on the remaining 5 openings as high-likelihood candidates for the source of
the initial gas release, and compared them against remaining criteria and other available evidence.
The remaining openings included the following:
1. A hole in a 2-inch nitrogen header connected to the PGC fifth stage suction line (the
postulated hydrocarbon source for this line would be the PGC fifth stage suction header).
2. A hole in a 2-inch hydrocarbon line carrying hydrocarbon condensate from the coalescer.
> , . • U'» " •' • ' i: , • ' ">.- 'it. ,' '; ;::" •'•.•..•'. • •' •'",'•' •:;'' ' '
3. A hole in a 2-inch hydrocarbon line carrying vent gases from the process gas drier.
13.
Most of these 47 openings failed multiple criteria. The above analysis indicates only the primary criteria used to
eliminate a particular opening.
' ":': , ', , ' ' 16' '' ' '' "''.
-------
4. A hole in a 6-inch line carrying gasoline from the coalescer to the high-pressure stripper feed
heater.
5. A hole in a 36-inch pneumatically assisted check valve located in the main process gas
compression line, between the fourth and fifth compressor stages.
Metallurgical and Mechanical Findings and Analyses
Each of the five remaining openings were in systems which normally contained or could
have contained flammable light hydrocarbon gases under sufficient pressure to produce a large
vapor cloud if released, and were located in the right area and with the right physical orientation
to corroborate eyewitness accounts of the vapor cloud formation and dispersion. However, the
physical condition of the pipe or component opening responsible for the initial leak must also
corroborate other eyewitness accounts and physical evidence. Specifically, numerous eyewitness
accounts indicated that the gas release was sudden (i.e. there was no buildup) and constant, and
that no, fire occurred prior to the explosion. Therefore, metallurgical analysis of the component
responsible for the initial leak would likely indicate that the component had experienced a sudden,
brittle failure, rather than a ductile rupture produced by extreme heating.
Piping or component sections containing the five high-priority line openings were removed
from thek respective systems and transported to a local Shell laboratory facility for detailed
metallurgical and mechanical analyses. Both Shell and EPA/OSHA investigators conducted
standard metallurgical and mechanical testing of equipment samples and shared the results.
Testing conducted included macroscopic and microscopic visual examination, fractography,
hardness testing, and dimensional measurement.
Analysis of samples numbered 1 through 4 above indicated that their failure occurred by
ductile rupture following high temperature oxidation, corrosion, and fire damage to each pipe's
external surfaces. In other words, thesefailures all resulted from the fire, and therefore could
not have caused it.
Analysis of sample number 5, the 36-inch diameter Clow Model GMZ check valve (and its
internal -components), revealed that it had suffered little or no heat damage. Analysis also
indicated the following (see Figures 2 and 3 on pages 25-26 for an illustration of the valve):
Fractured Dowel Pin
- a 2 inch long, Vz inch diameter cylindrical steel dowel pin which connected the valve's
drive shaft to its disk had fractured and sheared.
- The end of the dowel pin hadbeen drilled and tapped and a .25-inch diameter threaded
machine screw had been inserted in the hole. The purpose of the threaded hole was
apparently to allow later removal of the pin after its insertion in the shaft and disk ear.
17
-------
- The fracture occurred through the transverse (circular) cross section of the dowel pin
and through the drilled hole.
- The fractured dowel pin had been case-carburized on the outside diameter and on the
inside surface of the threaded screw hole. The carburized case structure consisted of
tempered martensite and small amounts of retained austenite. The core structure of the
pin contained Widmenstatten ferrite and unresolved pearlite.
- The morphology of the pin fracture surface indicated failure occurred by brittle overload.
No evidence of cleavage separation (ductile overload) was observed. No evidence of
arrest lines or fatigue striations was observed. The "rock candy" fracture morphology was
consistent with hydrogen embrittlement failure mode (see Appendix E, figure E-20).
Drive Shaft Key Clearance Too Large
- Although the shaft key (which was much larger than the dowel pin) was intended to
transmit torque from the drive shaft to the valve disk, it fit too loosely in its key slot (see
Appendix E, figure E-14). The total clearance (slack) of the key was between .045 and
.050 inch. The dowel pin had an interference fit (no clearance). This caused the dowel
pin to carry all of the rotational torque load transferred between the drive shaft and valve
- Hardness measurements of the shaft key indicated that the material used to fabricate the
key was relatively soft and ductile.
- The gap between the disk ear and valve body as measured was sufficient to allow the
shaft key to fall out of its keyway as the unrestrained shaft translated outward under
system pressure.
1 ' '!"' i* !' ' ;' ' ' ' ,''',',„ , ' ;' ",",,'' ' . ., ,
- The valve's drive shaft key was found, unattached, lying inside the body of the valve.
Combined with 'the dowel pin's failure, the displacement of the key essentially
disconnected the drive shaft from the valve disk. No other retaining mechanism (other
than friction) prevented the drive shaft from being expelled from the valve by internal
system pressure.
Analysis showed that the dowel pin's failure was caused by the excessive stress placed on
the pin as it transferred essentially all operating torque from the drive shaft to the valve disk (a
function which should have been performed by the much larger shaft key). Since the dowel pin
was not designed to carry such high stress, it eventually failed. The dowel pin Was also found to
18
-------
have experienced hydrogen embrittlement which'contributed to its fracturing.14
In summary, metallurgical and mechanical analyses indicated that the fifth stage suction
check valve likely underwent drive shaft blow-out (i.e. violent ejection of the drive shaft out of
the valve body) resulting from the brittle fracture of the drive shaft dowel pin and subsequent
displacement of the drive shaft key. Once the drive shaft was unrestrained, it was expelled from ,
the valve under the force created by internal system pressure acting on the end of the drive shaft.
Since no evidence was found to indicate that the valve's failure was caused by the fire,
investigators inferred from the above facts that the fifth stage suction check valve was the likely
primary failure point and the likely source of the initial flammable gas release.
Appendix E contains photographs of various components analyzed in the laboratory and
details of metallurgical and mechanical findings (Figures E-9 through E-22).
Analysis of Process Parameter Trends •
Analysis of process parameter trends allowed investigators to accurately determine the
elapsed time between the start of the gas leak and the explosion and confirmed investigators'
theory that the fifth stage suction check valve was the source of the initial gas leak. Investigators
desired to accurately determine the elapsed time between the start of the gas leak and the
explosion in order to estimate the amount of gas in the vapor cloud prior to its-ignition and to
model the vapor cloud explosion. However, witness statements related to. the elapsed time varied
widely enough that no,single witness estimate was considered to be reliable. The most accurate
indication of elapsed time between the start of the gas release and the explosion was obtained by
analysis of PGC system parameter levels around the approximate time of the accident. These
parameter levels were automatically recorded by the OP-IIIODS roughly every minute during the
PGC startup and until the explosion. Process parameters recorded by the ODS showed the
following significant trends around the time of the gas release and explosion:
• PGC fifth stage discharge pressure: Increased normally during PGC startup and stabilized
at 9:52 a.m. at approximately 500 psig, where it remained until 10:03 a.m. Between 10:03
and 10:07 a.m., PGC fifth stage discharge pressure dropped steadily from 5.00 psig down
to 470 psig (i.e. a total change of 30 psi). Immediately thereafter, fifth stage discharge
pressure (as well as all other PGC pressure readings) abruptly dropped to zero.
• PGC fourth stage discharge pressure: Increased normally during PGC startup to a peak of
316 psig at 10:03 a.m. Between 10:03 a.m. and 10:07 a.m., pressure dropped steadily
from 316 psig to 263 psig (i.e. a total change of 49 psi). Immediately thereafter, fourth
stage discharge pressure abruptly dropped to zero. ,
Hydrogen embrittlement is a form of chemical attack on steel where atomic hydrogen diffuses into steel, forming
molecular hydrogen in intergranular voids in the steel. The buildup of molecular hydrogen inside these voids can generate
internal pressures of up to several thousand psi. The steel consequently suffers a loss of ductility, develops micro fissures at
grain boundaries, and eventually cracks, all of which lead to a loss of strength.
19
-------
• PGC fifth stage suction pressure: Increased normally during PGC startup to a peak of 314
psig at 10:03 a.m. Between 10:03 and 10:07 a.m., pressure dropped steadily from 314
psig to 290 psig (i.e. a total change of 24 psig, or about half the change observed in fourth
stage discharge pressure). Immediately thereafter, fifth stage suction pressure abruptly
dropped to zero.
PGC mass flow rate: Between 10:03 and 10:07 a.m., PGC fifth stage discharge flow rate
steadily dropped by approximately 20,000 Ibs/hr. PGC fourth stage discharge flow,
however, abruptly increased at 10:03 a.m. by approximately 120,000 Ibs/hr, and then
steadily decreased until 10:07. After 10:07 a.m., both PGC fourth and fifth stage
discharge flow rates abruptly dropped to zero.
These trends indicate that PQC system pressures increased normally during the final PGC
startup, and remained normal until approximately 10:03 a.m. Immediately thereafter, system
pressures began a gradual and abnormal decline through 10:07 a.m.. This indicates that the gas
leak began at or shortly after 10:03 a.m. and before 10:04 a.m. At 10:08 a.m. virtually all relevant
parameter readings (pressures, levels, flow rates, etc.) abruptly drop to and remain at zero,
indicating that the explosion occurred after the 10:07 reading and before the 10:08 reading (the
explosion destroyed parameter sensing instruments and transmission lines, causing all subsequent
readings to fail to zero). Therefore, the elapsed time between the start of the gas leak and the
explosion was roughly 4 minutes.
,. . • • ,"»i,| • •; V" './I • ' • "; • ., ": -':"'"'-'' '• •;• ''•;:1;,' i1, • . •) •.';'•
Analysis of parameter trends also indicated that the gas leak occurred somewhere between
the fourth and fifth compressor stages, and therefore corroborated the theory that the leak
occurred at the fifth stage suction check valve (which was located just upstream of the fifth stage
suction drum). The following two parameter trends support this conclusion:
1) At 10:03 a.m., with the PGC still running at full speed, an abrupt increase in fourth
stage flow rate occurred, while fifth stage flow rate simultaneously began to decrease.
This indicated that a leak had occurred downstream of the fourth stage, but not
: downstream of the fifth stage.
'';• ' -•• .- •••!! '! ; ; .: »:';'':. ;/; •;i:/'rv,/vJ./'' ' ' • ' ,'; ' . .
2) Between approximately 10:03 and 10:07 a.m., PGC fourth stage discharge pressure
dropped about twice as fast as fifth stage suction drum pressure (the two pressures
normally differ by only 3 or 4 psi during normal operations) and nearly twice as fast as
fifth stage discharge drum pressure. This indicated that a leak had occurred upstream of
both fifth stage drums, since if the leak was downstream of either fifth stage drum, that
drum would have depressurized relatively faster than the fourth stage discharge drum.
Vapor Cloud Rxplosion Modeling
,; ,'";„; ' " ' , ' • , *•
!!: • M : ' ,i IP! ',!" '[,,„, •'!,'. " j, ' i
Investigators carried out analyses to model the formation and explosion effects of the
presumed vapor cloud produced by the gas released from the 3.75-inch diameter hole in the fifth
20
-------
stage suction check valve. The modeled vapor cloud was then compared to observed blast effects
in order to determine if the two were consistent. Specifically, investigators sought answers to the
following questions: r
• What weight of gas was released from the failed check valve?
• What fraction of the gas released was involved in the explosion and what was its TNT
equivalent?
• Would the vapor cloud explosion modeled by these parameters be consistent with
observed effects?
Using several different methods to model gas release rates and explosion effects, «
investigators concluded the following:
• Approximately 15,000 pounds of process gas was released from the hole in the fifth stage
suction check valve prior to the explosion.
• Approximately 3,000 pounds of gas was involved in the explosion (for a yield factor of
0.2), which was equivalent to about 31,000 pounds of TNT15.
• A vapor cloud containing this much gas, if rapidly released into a highly congested area
with a volume of about 20,000 cubic meters (the estimated congested volume of the vapor
cloud) and ignited, would likely generate overpressures sufficient to produce the effects
observed at Shell.
In short, vapor cloud explosion models based on a theoretical gas release from the hole in
the fifth stage suction check valve were consistent'with the actual blast effects observed at OP-m,
further confirming the theory that the gas release originated at the subject valve. Appendix D
contains details of vapor cloud modeling and analyses.
. N ,
Other Corroborating Evidence "
Other evidence and analysis also validated the theory that the leak began at the fifth stage
suction check valve:
While vapor cloud explosions are commonly converted to TNT-equivalent explosions for purposes of comparison,
TNT explosions and vapor cloud explosions have different characteristics. The destructive power of an explosion is based on
numerous factors, including explosive parameters such as characteristic detonation velocity and pressure, confinement,
tamping, method of initiation, impulse profile, and brisance value, and site parameters such as stand-off distance from surfaces.
Specifically, the overpressure at the center of a vapor cloud explosion is much less than that at the center of an "equivalent"
TNT explosion. So, even though approximately 31,000 pounds of TNT would have been necessary to produce the far-field (< 1
psi overpressure) blast effects observed at Shell, a much smaller amount of TNT would have produced equivalent near-field
effects. ' . ' • ' ' '
. • ' ' . 21 ' . ;
-------
• After the fire, the shaft and counterweight from the fifth stage suction check valve were
found partially buried beneath several sections of damaged piping and several inches of
debris and sludge. However, the shaft and counterweight were lying directly on the
ground surface with virtually no debris underneath them. This indicated that they landed
at or near the beginning of the accident and were subsequently covered by debris from the
explosion and fire.
• Engineering calculations indicated that the unrestrained drive shaft and counterweight
assembly, with a combined weight of approximately 200 pounds, if ejected from the valve
under normal operating pressure'(300 psig), would travel a minimum of 12 feet, and
probably much farther before striking the ground. The shaft and counterweight were
found 42 feet directly southof the valve, in an unobstructed line of travel.
• A gas release from the drive shaft hole in the 5th stage suction check valve would account
for the various eyewitness statements related to vapor cloud formation and dispersion.
: .; , • • n IB •'>.«. . - . -i. i. • . •- if-.- . f
Eyewitnesses located underneath the pipe rack and south of the valve observed vapor
blowing rapidly to the south, which is consistent with the direction of the high velocity gas
jet emanating from the failed valve. Once the vapor cloud expanded out of the direct path
of the gas jet, however, it would have drifted upward due to both the updraft produced by
the overhead cooling fans and the fact that a substantial fraction of it was less dense than
air. The cloud would also have started drifting northward with the prevailing breeze. This
accounts for'the observations of witnesses located to the northof the pipe rack, who
observed vapor billowing over the 5th stage drums and drifting roughly to the north.
i : ,'..ii • , . .-':•. . , , ' ; : ii ' • ' . ' • •'•:•• < ,•"' " • (i ' „ ' ' ' .
• To locate the approximate explosion center, Shell investigators conducted a bolt-stretch
analysis. This was done by measuring the plastic deformation of metal anchor bolts of
large equipment structures surrounding the blast area. Strain calculations indicated that
the explosion center was located approximately 80 feet directly south of the PGC fifth
stage suction drum. This point is ahnost directly in the path of the vapor jet that would
have been produced by the gases escaping from the hole created by the absence of the
drive shaft in the fifth stage suction check valve.
, ' " . ' ,' II „ ., ' ', ' "il • , '' ,' i 'i • ,», , ""• ' s," ,J " •!' '
* The PGC automatically tripped between five and seven times on the morning of June 22,
1997 before the accident (3 to 5 trips from slow roll and 2 trips while at or near full
speed). Each compressor trip actuated the four Clow Model GMZ check valves, which
quickly slammed shut (as designed to prevent compressor damage from reverse gas flow).
These events placed large and repeated stresses on internal valve components.
• Maintenance records showed that the fifth stage suction check valve was the only one of
the four Clow Model GMZ pneumatically-assisted check valves installed in the PGC
system never to have been inspected and repaired. The other three check valves had been
inspected and repaired following a 1991 incident at OP-III (see page 26), and were found
to be generally intact following the explosion and fire.
i , '.»"' i,;i „ . ' "' ' „ . ' , , , "' .1
; . •.•; '.• • • • •, -, 22 ' ''' " ' ' .
-------
• Investigators determined that failure of Clow Model GMZ check valves was a factor in
several other incidents at Shell facilities, including one serious gas release occurring in
1991 at a facility in Saudi Arabia partly owned by Shell. The circumstances preceding
some of these prior incidents were remarkably similar to those in this accident (see pp 26-
28).' .'••''• . • •. :
Ignition Sources ,
Guidelines for Evaluating the Characteristics of Vapor Cloud Explosions, Flash Fires,
and BLEVEs (Center for Chemical Process Safety of the American Institute of Chemical
Engineers, 1994), states that, "In general, ignition sources must be assumed to exist in industrial
situations." This is because in many industrial settings, ignition sources are ubiquitous and
extremely difficult or even impossible to completely eliminate. Common industrial plant ignition
sources include hot steam lines, sparks from friction between moving parts of machines, and open
fire or flames from furnaces, heaters, or flares. Consequently, while plant designers'strive to
minimize ignition sources, the primary strategy for preventing vapor cloud explosions in chemical
plants, refineries, and the like is to prevent formation of flammable vapor clouds 16.
Investigators determined that several ignition sources were present in the area of the OP-
III explosion. These included at least the following: exposed piping flanges on the 1250 psig
steam header in the south yard pipe rack, exposed hot surfaces of kerosene furnace transfer lines
at their entrance to the fractionator, exposed hot surfaces of the dilution steam superheater and
associated steam piping, and exposed surfaces of the fuel oil stripper stripping steam super heater.
Other ignition sources, such as sparking electric apparatus, or friction between moving parts of
nearby machines, may also have been present. The, JCAIT was unable to determine which of
these ignition sources actually ignited the vapor cloud.
Immediate Cause of the Accident
Based on the evidence and analysis hereinbefore presented, the JCAIT concluded that the
flammable gas release was caused by the internal structural failure and drive shaft blow-out of the
36-inch diameter Clow Model GMZ check valve located on the suction side of the PGC fifth
stage. Due to the failure of the drive shaft dowel pin and displacement of the shaft retaining key,
the drive shaft of the valve detached from the valve disk and was expelled out of the valve body
under system pressure. The absence of the drive shaft left a 3.75-inch diameter hole in the valve
and allowed the compressed gases in the PGC system to escape at high velocity. The gases were
released as a turbulent jet into an area congested by numerous vertical and horizontal structures,
forming a flammable vapor cloud which subsequently ignited and exploded. Appendix C contains
an Events and Causal Factors Chart of the accident sequence and subsequent events.
- This is in contrast to measures taken to prevent vapor explosions within aircraft fuel tanks, where the primary
strategy has historically been to eliminate all possible ignition sources.
• ' ' . " ' 23
-------
Clow Model GMZ Check Valve Information
17
The JCAIT determined that four Clow Model GMZ pneumatically-assisted check valves
weni installed in thie OP-ni process gas compression system and were located on the suction lines
of ihe third and fifth compressor stages and on the discharge lines of the fourth and fifth
compressor stages. The check valves were installed in 1976 as original plant equipment and were
designed to permit process gas flow in only the forward direction. This is accomplished through
the action of the valie's hinged disk, or flapper, which swings open during forward process gas
flo^f and swings shut when gas begins to flow in the reverse direction (hence the common name
"svying" check valve). A pneumatic system is interlocked with the PGC shutdown system and
operates during an automatic compressor trip or manual shutdown. The pneumatic system
applies a moderate force to hold the valve closed to minimize valve leakage and valve swinging
following a compressor shutdown.
Reverse flow is the natural result of stopping a centrifugal compressor; compressed gas in
the high pressure section of the plant tends to flow back to the low pressure section. Reverse gas
flow is an undesired condition. It can damage a centrifugal compressor, such as the PGC. Also,
any hydrocarbon that flows backward from the high pressure section of the plant to a lower
pressure section may be vented to prevent the equipment in the low pressure section of the plant
from over pressuring when the compressor is stopped. Check valves are installed to prevent this
reverse flow in the event of a planned shutdown or trip of a centrifugal compressor.
The potential for reverse flow also exists in upset operating conditions commonly referred
to as "compressor surge" or "surging". Surging can occur when a centrifugal compressor has
insufficient gas flow, and the process flow rapidly switches from normal forward flow, to reverse
flow, back to forward flow. During these rapid flow reversals, the check valves in the compressor
suction and discharge pipe rapidly and repeatedly close and open. This often produces a forceful,
loud "slamming" of the valve disk against the valve seat. The instant the valve closes, a very high
unbalanced pressure can develop in the pipe due to the rapid interruption of the reverse flow. The
combination of the high, unbalanced pressure, plus the valve disk slamming can cause significant
temporary deflection in the pipe. In such cases, operators have described the valve and attached
pipe as "jumping" out of the saddles.
Clow Model GMZ check valves (see Figure 2) contain a two-piece stem in which one
Clow Model GMZ Check Valves were manufactured by the Clow Corporation of Westmont, Illinois, and were
marketed under the TRICJENTRIC® trademark The Clow Corporation of Westmont Illinois no longer exists, having been
purchased by the C&S Valve Company, which itself was later purchased by Atwood & Merrill, Inc., of Salem Massachusetts.
Atwood & Morrill, Inc., still markets valves under the TRICENTRIC ® trademark, and is therefore referred to later in this
report as the "successor" to the Clow Corporation of Westmont, Illinois. The TRICENTRIC® trademark refers specifically to a
unique triple offset seat and seal design used in certain valves and is unrelated to drive shaft retention. It in no way implies
that products marketed by Atwood & Morrill Company, Inc. under the TRICENTRIC® trademark may be subject to the same
failure as the Clow Model GMZ valves described in this report. The Clow Corporation of Westmont Illinois should not be
confused with the currently existing Clow Valve Company of Oskaloosa, Iowa.
'• . , ' '. ' ' ': 24
-------
stem piece functions as a drive shaft and connects the internal valve disk to an external air-assist
cylinder and flapper counterweight assembly. The other stem piece, or idler shaft, simply
functions as a hinge for one side of the flapper. The drive shaft penetrates the pressure boundary
through a stuffing box. The exterior portion of the drive shaft is connected to the pneumatic
piston and counterweight, and the interior portion of the shaft is coupled directly to the valve disk
using a cylindrical hardened steel dowel pin and a steel rectangular bar key (see Figure 3). This
arrangement provides a counter weight to partially balance the weight of the valve disk, and
provides the pneumatic power assist to maintain the valve closed as described above.
The Clow Model GMZ check valve installed as the PGC fifth stage suction check valve
had an internal diameter of 36 inches and weighed 3.2 tons. The valve had a design limit pressure
of 480 psig, and a design limit temperature of 115 degrees Fahrenheit. The JCAIT found no
evidence that these limits were exceeded at any time prior to or during the accident.
Simplified cross-sectional view of check valve (flow direction is into page)
Counterweight
Area of Failure
Dowel Pins
Valve Disc (flapper
, shown in open position)
Direction of Blowout
^Air-assist cylinder
Valve Body
Figure 2: Clow Model GMZ Pneumatically-Assisted Check Valve
25
-------
EO\EL
HN
Figure 3: Expanded View of Check Valve Disk/Shaft/Key/Dowel Pin Arrangement
Previous Incidents Involving Clow Model GMZ Check Valves at Shell Facilities
n , 'i , ,. ,, i, , . ., . . i
In addition to this accident, several other incidents invplying malfunctioning Clow Model
GMZ check valves have occurred at Shell facilities. These included the following:
Mav. 1991 Clow Model GMZ Check Valve Malfunction at OP-III
In May 1991, OP-IE was being started up following a five-week maintenance period.
Operators started the PGC with gas flow from four fractionation furnaces. After the PGC was
brought up to full speed, operators observed that the compressor began to surge 1S. The
intermittent reverse gas flow caused the check valves located between compressor stages to
repeatedly slam shut and re-open. One operator noticed that one of the check valves, located on
the compressor third stage suction line, was slamming shut every ten to fifteen seconds with such
force that the 36-inch diameter steel pipe to which the valve was connected noticeably "jumped",
or deflected upward and downward with each cycle of the valve. A different check valve located
on the fourth stage discharge line was also observed to slam shut and re-open several times, but
not as often or as forcibly as the third stage suction check valve.
Tlic surging (reverse gas flow) in this event likely resulted from the fact that four furnaces provided insufficient gas
load to the PGC. Operating practices were later changed to require the PGC to be fed process gas from at least six furnaces.
' , ' - . • - r •• •' • >• 26
-------
On closer inspection, operators observed several indications that the third stage suction
check valve was malfunctioning. These indications included a small but noticeable amount of gas
leaking out of the valve around its drive shaft, a slight outward axial displacement of the drive
shaft, and the erratic operation of the valve, which was observed to operate independently of its
external drive mechanism. Because of these indications, employees inspected the three other.
Clow check valves installed in the PGC system for similar problems. Employees noted that two
of the three remaining valves (fourth and fifth stage discharge check valves) had gas leakage
through the idler (non-drive) shaft packing and packing end plate. The fourth valve (fifth stage
suction check valve) appeared to be functioning normally.
In spite of the indications that one check valve in the system was malfunctioning and two
other valves had packing leaks, plant startup continued. About one hour after the first
compressor surging was noted, two additional pyrolysis furnaces were brought on line (for a total
of six) to add additional load to the PGC. This prevented further reverse gas flow and stabilized
the compressor.
Upon further evaluation of the malfunctioning third stage suction check valve,
maintenance technicians concluded that an internal dowel pin and shaft key in the valve had failed,
allowing the disk to open and shut independently of its drive shaft, and allowing the axial
movement of the drive shaft. Because of this fact and the leaks observed in two of the three
remaining check valves, employees decided to shut down the PGC and remove the third stage
suction check valve for repair and to remove the other two leaking check valves for inspection
and possible repair. Employees decided not to remove and inspect the fifth stage suction check
valve,(the subject valve of this report), since it appeared to be functioning normally.
The next morning, the PGC was shut down and the one malfunctioning valve and the two
valves with leaks were removed. At the time of the shutdown, the drive shaft on the third stage
suction check valve was protruding approximately 3/4-inch out of the valve. Subsequent internal
inspection of the third stage suction check valve revealed that two internal metal dowel pins
designed to connect the drive shaft and non-drive shaft to the valve disk had sheared, and that a
shaft key which coupled the drive shaft and disk was missing. With guidance from an experienced
engineering representative of the valve's manufacturer, maintenance technicians fabricated
replacement dowel pins and a shaft key in the machine shop and repaired the third stage suction
check valve.
The two valves with leaks were disassembled and inspected. The dowel pins and shaft
keys on both of these valves did not appear to be damaged, but since the valve's shaft packing
material had become brittle and was crumbling, causing the leakage from the non-drive end of the
valves, technicians decided to replace it with new packing. Since packing replacement required
the removal of the drive end and non-drive end shafts, it was necessary for technicians to remove
the old dowel pins which held the shafts in place, so these dowel pins were also replaced with
newly fabricated pins. Original shaft keys for these valves were re-used.
27
-------
The three cjjeck valves were reinstalled on Wednesday, May 22, 1991, and the OP III was
started without further incident. The JCAIT found no evidence to indicate that further
IV ' j in1 ih"Li! , • "' •',,"' \ ' i1 •; i",i ' • ." "lif ,'•,• • i '"" '', n.'i' 'ni ' ' ,ir " •, '••• ',.', v " 'il'liii i .
maintenance or internal inspections were ever performed on any of the PGC system
pneumatically-assisted check valves prior to the 1997 accident, and various witnesses confirmed
that none ever occurred.
December. 1991 Propane Gas Release in Saudi Arabia
In December 1991, Saudi Petrochemical Company (SADAF), a chemical plant located in
Saudi Arabia and partly owned by Shell Chemical Company, experienced a release of propane gas
when a Clow Model GMZ check valve experienced shaft blow-out. Many circumstances hi this
incident were similar to those in both the June 1997 accident and May 1991 incident. The
incident occurred fallowing a process upset in the facility's ethylene plant, where the inadvertent
shutdown of a cracked gas compressor resulted in downstream flow instabilities and initiated a
13-hour period of surging in the unit's propane refrigeration compressor. During this period, the
Clow Model GMZ check valves installed in the propane refrigeration compression system
slammed shut repeatedly.
The shaft of the compressor's third stage discharge valve eventually separated from its
disk and was partially ejected from the valve. The shaft was not fully ejected because its path was
blocked by an adjacent steam line inches away from the valve, keeping about 70 mm of the shaft's
length within the valve body. Propane gas began to leak out of the valve around the gap between
the shaft and its stuffing box until operators discovered the leak and shut down the compressor.
Operators also discovered that the valve's drive shaft counterweights had broken off of the drive
shaft and had been propelled approximately 16 meters from the valve.
The facility was fortunate in this case. An adjacent steam line kept the shaft from being
fully ejected from the valve, thus limiting the leak rate and preventing an accident of potentially
much greater severity. It was also fortunate that no one was struck by the counterweights when
they were propelled from the valve.
A subsequent investigation by SADAF and analysis of the check valve's internal
components revealed that the dowel pin which secured the drive shaft to the valve flapper had
sheared, and the shaft key had fallen out of its keyway (the same failure mode identified in the
1997 accident at Deer Park).
," ' • • Hi1 ,i',i,iii"i'ii ' ">:,, ', "• ' i" • • ",''', ,"' ' vi,, • ' • ' „ i1,:, „ , - «!"••! • •:
The SADAF investigation report also revealed that facility maintenance records indicated
a. Iqng history of problems with the Clow Model GMZ check valves installed there. The valves
were installed in 1982, and due to continuing valve malfunctions, underwent repair or
modification in 1984, 1986, 1987,1989, and 1990. These repairs and modifications included
replacement of damaged counterweight arms, replacement of seals and gaskets, replacement of
dowel pins and internal keys, and installation of external shaft "keepers". The investigation report
indicates that the purpose of the external shaft keepers was to limit shaft "float" (minor shaft
:"V '.' •''• : 28 ' , , •" ,
-------
movement). SADAF and Shell personnel stated that the keepers were not specifically intended to
prevent shaft blow-out Nevertheless, since they functioned to limit axial shaft movement, the
external keepers might have prevented shaft blow-out. Ironically, when valve internals were
serviced in 1990, the external keepers were no longer thought necessary and were therefore
removed and never reinstalled.
1980 and 1994 Incidents at Shell Facility in Norco, Louisiana
In 1980 and 1994, a Shell facility in Norco, LA experienced failures involving Clow
Model GMZ check valves. In both cases, shaft-disk separation occurred when the dowel pin
fastening the valve's drive shaft to its disk sheared (in the 1980 case the pin was possibly never
installed by the manufacturer), and a rectangular key fell out of its keyway, disconnecting the
drive shaft from the disk. Although separation of the shaft and disk occurred in both of these
cases, it did not result in shaft blow-out in either case. This may have been because the valves in
these instances were installed in lower-pressure service, or because the malfunctions were
identified before complete shaft blow-out occurred. In both cases, the malfunction was identified
when employees noted that the external piston rod connecting the air-assist cylinder to the drive
shaft had broken due to outward axial movement of the drive shaft.
Lessons Learned by Shell from Previous Check Valve Incidents
The JCAIT reviewed maintenance records from the 1980, May 1991, and 1994 check
valve malfunctions. Shell personnel stated that these events were treated as maintenance actions
and were not considered "accidents" or "incidents". Therefore, no formal investigations were
conducted to determine their root causes or to determine lessons learned from the events.
Consequently, other than the immediate repair of the malfunctioning components and a later
change in operating practice requiring that the PGC be fed process gas from at least six furnaces
(to limit compressor surging), no actions were apparently ever taken to prevent future incidents
involving Clow Model GMZ check valves at Shell Deer Park. The JCAIT did not determine
whether or not such actions were ever taken at other Shell facilities as a result of these events.
In the case of the December 1991 check valve incident in Saudi Arabia, a significant
propane gas leak had occurred and facility personnel recognized that the incident could have been
much more severe than it was. A formal investigation by SADAF personnel was conducted in
order to determine the causes of the incident and to make recommendations to prevent recurrence
of similar incidents. However, although a Clow Model GMZ check valve was determined to be
the source of the leak in this event, the SADAF investigation did not specifically identify check
valve design deficiencies as a cause of the event. Instead,, investigators attributed the check
valve's failure as the secondary result of a malfunctioning "kickback" valve 19 which caused
compressor surging and repeated check valve slamming. Consequently, the majority of -
19 • •
"Kickback" valves function to feed back a portion of the discharge gas flow from a given compressor stage to the
inlet of that stage in order to artificially increase compressor gas load and thereby prevent reverse flow or "surging".
• 29
-------
recommendations in the report focused on preventing compressor surging rather than the check
valve itself. The report states:
"The importance of limiting surge cycles to an absolute minimum can not be over-
emphasized, therefore the recommendations listed below should be dealt with the utmost
priority."
While the subsequent recommendations focused primarily on eliminating compressor
surging, one recommendation was specifically relevant to the Clow check valves. This
recommendation was:
"Evaluate the need to retrofit dampening devices as well as pull and inspect all NRV's on
11K2 and 1|K3 during the nextethylene plant t/A"20
: " i ,, ::,4 :;.' ' ; . '} .:'!(• '"'',, '•• ;•"'•" ;[; i. r";'! :;'.;'''; ' ,",/ ' 7!'•;•'••; :•
Additionally, although not specifically recommended in the report, the JCAIT determined
that after the incident, a full external restraining bracket was built around the valve with the
intention of providing secondary containment of the shaft should the internal restraining
mechanisms ever completely fail. The JCAIT did not attempt to verify whether or not the other
recommendations from the SADAF incident investigation were implemented at that facility, but
three things are clear:
', - i! . • ' , :,;, t. , • I • ,
1) Dampening devices were never installed on Clow Model GMZ check valves at OP-III,
2) None of the Clow check valves were ever "pulled and inspected" following the repairs
performed subsequent to the May 1991 event at OP-III, and;
3) External restraining brackets were never installed on the Clow check valves at OP-III.
'.'•. ' '. i!i*r •• : ' ' ": ::': ' '• •!.'•' •.''•' .'' " '"l : : : ' ':V: -'::!< > : •• , " •- '
The JCAIT found no evidence that any of the lessons-learned or recommendations
resulting from the SADAF incident were ever implemented at Deer Park or shared with other
Shell facilities.
^
i: . . , , ,:••!' ": ',' '..•,."•(;.: • ' "
Other Information
\
Shell Chemical Company Analysis of OP-Hl Process Hazards
•i ' . i1 ' .Viji • „ •:' '" t,! •' . /i:1: . . • '. • ,' : . ' ' v. > M . • i
The JCAIT determined that Shell Chemical Company performed a Process Hazards
Analysis (PHA) for the OP-IU PGC system in 1991. The JCAIT also determined that Shell was
in the midst of performing this PHA when the May, 1991 check valve malfunction event occurred
20 "NRV" is an abbreviation for Non-Return Valve, another term for check valve. "11K2" and "11K3" are facility
designations for the ethylene and propane compression systems, respectively. "T/A" is an abbreviation for "turnaround", which
is industry jargon meaning planned maintenance period.
: .' TNI , " " ' '... ' , ' ' ' , '' ' „ ' f '.,
I/1!'.; • . • : ' ; '.' , ', . " . : iK , ,
' • :-! ' : ' : 30 ' ' " '. ' ' ' .
-------
at OP-III. In fact, employees stated that the PHA was suspended while the three check valves
were repaired, since the engineers responsible for performing the PHA were also needed to repair
the malfunctioning valves21. However, a review of the PHA showed no evidence that check valve
failure or shaft blow-out was considered in the analysis, and the JCAIT found that no measures
were taken as a result of the PHA to prevent a potential check valve shaft blow-out accident.
Operating Procedures
The JCAIT reviewed OP-III operating procedures for the PGC system to determine if the
procedures or related operator actions were a likely factor in the accident. The; JCAIT
determined that written procedures for starting up the PGC in various modes existed, that
operators were knowledgeable of the procedures, and intended to start-up the PGC in accordance
with applicable written procedures on June 22,1997. The JCAIT determined the following
significant facts related to PGC operating procedures:
• Operating procedures did not contain any warnings, caution statements, or safety
measures related to preventing check valve shaft blow-out, flammable gas releases, or
vapor cloud explosions. The "Safety Precautions" section of the procedures addressed
only hazards related to steam leaks, chemical exposure, and high noise.
. • . "'
• Operating procedures identified the possibility of a compressor trip due to high vibration,
but did not contain any contingency actions in case such a compressor trip actually
occurred. Operators stated that automatic compressor trips occasionally occurred during
PGC start-ups (as was the case on the morning of June 22).
• Operating procedures required operators to confirm that all air-assisted check valves were
open by visually inspecting the valves prior to starting the PGC. However, operating
procedures did not specifically instruct operators to re-verify the position of these valves
following an inadvertent compressor tripoccurring during startup.
• Operators stated that they verified the position of all air-assisted check valves-prior to the
next to last PGC startup on June 22, but did not re-verify the positions of the check valves
(or perform any other pre-startup checks) after the compressor subsequently tripped due
to high vibration.
Root Causes and Contributing Factors
Root causes are the underlying prime reasons; such as failure of particular management
systems, that allow faulty design, inadequate training, or deficiencies in maintenance to exist.
These, in turn, lead to unsafe acts or conditions which can result in an accident Contributing .
The PHA was actually suspended twice during 1991. Once for the repair of the check valves, and on an earlier
occasion in order to allow the PHA team to assist with a scheduled maintenance period.
, - '. .. .31 '
-------
factors are reasons that, by themselves, do not lead to the conditions that ultimately caused the
event; however, these factors facilitate the occurrence of the event or increase its severity. The
root causes and contributing factors of this event have broad application to a variety of situations
and should be considered lessons for industries that operate similar processes, especially the
chemical and petroleum refining industries.
'•••: ' ' ' '• H«'" •'' ' ' •''.'.'I .'."'•>>• :;WJ!.:'.'.',.••;••. '';; '' ; •' '!: ' ' <
;;', . '!j! , , .' , -> ', ': t ". , 1 ,, ': . , •; '., .,.••' , , , '.-..'
The JCAIT used a variety of analytical techniques to determine the root causes and
contributing factors of the accident, and to generate recommendations to prevent recurrence.
The.se techniques included events and causal factors charting, fault tree analysis, root cause tree
analysis, and professional judgement. The JCAlT identified the following root causes and
contributing factors of the accident:
Root Causes
1) Inadequate Valve Design
The Clow Model GMZ check valves installed in the OP-III PGC system were not
appropriately designed and manufactured for the heavy duty service they were subject to in OP-
III. This resulted in the valves being susceptible to shaft blow-out during normal use.
"Normal" use of Clow Model GMZ check valves at OP-III included periods of high cyclic
loading. Operating practices during routine startups of the process gas compression system and
durjng recovery from process upsets subjected the system to intermittent automatic compressor
trips and occasional periods of surging (rapid flow reversals) which placed high stresses on the
check valves by slamming mem shut. On the morning of June 22nd, 1997, the valves slammed
shut after compressor trips on at least five and possibly as many as seven separate occasions.
Each of these cycles placed peak stresses on the fifth stage suction check valve and its internal
components, including the drive shaft dowel pin, and caused existing intergranular cracks to
propagate through the dowel pin, eventually fracturing it completely and initiating the shaft blow-
out. The fact that Clow Model GMZ check valves had experienced the same mode of failure
under similar circumstances on several previous occasions further confirms that they are not
appropriately designed for severe-duty applications.
A number of design factors contributed to the fifth stage suction check valve's failure,
including:
• The valve was inherently susceptible to shaft blow-out. This resulted primarily from the
, following two design elements: the valve's "stub-shaft" design and its lack of secondary
shaft-retention features. The term "stab-shaft" denotes a valve having a shaft piece that
penetrates the pressure boundary and terminates inside the pressurized portion of the
valve. This feature results in an unbalanced axial thrust on the.shaftwhich tends to force
it out of the valve. Since the fifth stage suction valve was located in a relatively high-
pressure portion of the PGC system (300 psig), the drive shaft was subject to a large axial
-------
thrust during system operation. The valve also did not contain any secondary shaft-
retention feature or device, such as a split-ring annular thrust retainer or a shaft with an
internal diameter larger than the internal diameter of its stuffing box. Therefore, when the
drive shaft separated from the disk, nothing (other than friction) prevented it from being
ejected out of the valve. .
• The shaft dowel pin carried too much stress load. The shaft key was intended to transfer
all of the torque between the drive shaft and disk. However, the excessive looseness of
the shaft key in its keyway combined with the tight fit of the shaft dowel pin resulted in the
relatively small diameter dowel pin (which was further weakened by the threaded screw
installation and the effects of hydrogen embrittlement) transferring all torque between the
shaft and the disk. The relatively large gap between the shaft key and its keyway also
permitted the key to fall completely out of the keyway as the drive shaft moved outward.
The excessive looseness of the shaft key in its slot was either the result of inadequate
design (e.g., inadvertently designing a key with a too-loose fit), inadequate manufacturing
(e.g., machining the key and keyway with more looseness than design specifications called
for), or both.
• The shaft dowel pin was susceptible to hydrogen embrittlement. Metallurgical analysis
indicated that the dowel pin was manufactured from case-hardened carbon steel and was
used in a hydrogen-rich environment, conditions leading to hydrogen embrittlement. This
probably led to the formation of intergranular cracks which propagated inward from the
exposed surfaces to the core of the dowel pin. This weakened the dowel pin, which was
already carrying more load than it was intended to carry. Other materials or other types of
steel not susceptible to hydrogen embrittlement should have been chosen for fabrication of
the dowel pins.
2) Failure to Learn from Prior Incidents
Lessons learned from prior incidents involving Clow, Model GMZ check valves installed at
Shell facilities and at Saudi Petrochemical Company (SADAF), a Saudi facility partly owned by '
Shell, were not adequately identified, shared, and implemented. This prevented recognition and
correction of the valve's design and manufacturing flaws at OP-HI prior to the accident.
Information available to Shell as early as 1980 suggested that Clow Model GMZ check
valves were problematic. In 1991, however, the two potentially very serious incidents involving
Clow Model GMZ check valves occurring within a period of eight months should have been clear
warnings that the valves presented a significant hazard. Both incidents involved very similar
circumstances and required the respective operating Units to be shut down specifically for repair
of the Clow check valves.
However, while the investigation of the incident in Saudi Arabia identified numerous
causal factors involved in that event, it did not focus on the failed Clow Model GMZ check valve
33
-------
itself and therefore the report did not identity all factors involved in the valve's failure. For
example, even though equipment records from the Saudi plant indicated a long history of
problems with the Clow Model GMZ check valves, the investigation report did not identify check
valve design features as possible factors in the shaft blow-out incident. Nevertheless, the fact that
a full external restraining bracket was installed around the valve after the incident indicates that
facility engineers recognized the valve's design flaws. If external restraining brackets had been
installed on the Clow check valves at Deer Park, the 1997 accident would almost certainly have
been avoided. Also, at least one of the Saudi mcident report's recommendations (i.e., to install
dampening devices), if implemented at Deer Park, might have prevented the 1997 accident.
At least one person at the Saudi plant recognized the potential severity of the valve's
failure. A handwritten note on the cover page of the company investigation report from the
incident reads:
"Could have been serious i'TsicI
In spite of this, The JcATT found no evidence that any actions were ever taken at the Deer
Park plant to prevent future incidents of this type. Lessons learned from the incident in Saudi
Arabia may not have been adequately communicated to, or understood by, Deer Park personnel;
for some reason they were simply not applied at OP-HI.
3) Inadequate Process Hazards Analysis
The process hazards analysis (PHA) of the process gas compression system was
inadequate; the PHA did not identity the risks associated with shaft blow-out in Clow Model
GMZ check valves, and consequently no steps were taken to mitigate those risks.
Formal hazard evaluations, such as PHAs, should identify potential failure areas that need
to be addressed by safeguards such as equipment design, engineering controls, maintenance, and
standard operating procedures. When conducting a PHA, companies should consider previous
incjidents related to the subject process and its equipment. However, during the 1991 PHA at OP-
III, Shell did not consider relevant previous incidents that had occurred at OP-IH and other Shell
facilities. Shell consequently missed an early opportunity to eliminate or minimize the hazards :
created by the check valves in the PGC system and avoid this accident.
The failure of the PHA to identity and address the hazards associated with Clow Model
GMZ check valves is particularly remarkable since the PHA (a process which required a Shell
engineering team several months to complete) was temporarily suspended specifically in order to
allow engineers on the PHA team to repair the Clow Model GMZ check valves that
malfunctioned in May, 1991.
34
-------
4) Inadequate Mechanical Integrity Measures
Measures necessary to maintain the mechanical integrity of Clow Model GMZ check
valves installed in OP-HI were not taken. This resulted in undetected damage to and eventual
failure of critical internal valve components.
The JCAIT found that the PGC fifth stage suction check valve had not been inspected for
internal mechanical integrity and had not received any internal maintenance since its original
installation, a period of over 20 years. The JCAIT also determined that the other three Clow
Model GMZ check valves installed in the PGC system had been inspected and repaired only once
- after the 1991 malfunction of the third stage discharge check valve. In his book, What Went
Wrong? Case Histories of Process PlantDisasters ^(Kletz, 1994), author and industrial safety
expert Trevor Kletz states: .
"Check valves have a bad name among many plant operators. However, this is because
many of them are never inspected or tested. No equipment, especially containing moving
parts, can be expected to work correctly forever without inspection and repair."
In spite of the fact that OP-III and Shell's Norco, LA facility had experienced significant
mechanical integrity problems with these valves, and of the fact that the Saudi Petrochemical
facility (partly owned by Shell) had documented a long history of mechanical problems with the
valves, the OP-III mechanical integrity inspection program did not include periodic internal
inspections of PGC system check valves or any other measure to evaluate or ensure their
integrity. If such inspections or other mechanical integrity measures such as periodic preventive
maintenance had been conducted, the Deer Park accident would likely have been prevented.
5) Inadequate Operating Procedures
Operating procedures for the start-up of the PGC system did not specifically instruct
operators to re-verify the position of pneumatically-assisted check valves before restarting the
compressor following unexpected automatic compressor trips, nor did they contain warnings or
caution statements related to prevention of hydrocarbon leaks or check valve shaft blow-out.
Consequently, operators did hot re-verify the position of the valve that failed. Re-verification
might have enabled operators to observe possible indications of the fifth stage suction check
valve's imminent failure on June 22, 1997.
The JCAIT found that operators were knowledgeable of PGC startup procedures and
generally followed them when conditions were normal. However, since the procedures did not
address unexpected situations or contain steps required to correct upset conditions such as power
outages or compressor taps, foremen and operators used their own discretion in deviating from or
adapting the procedures during upset or abnormal conditions. Such was the case on June 22,
, 1997; since PGC operating procedures did not contain specific requirements for re-verification of
equipment status following an unexpected automatic compressor trip or any warnings related to
• ' ' ' 35' "' - .' -
-------
check valve shaft blow-out, operators elected to immediately re-start the compressor after a high-
vibration trip, without performing any further equipment checks.
i. . vi'iU " ' ' •'• ' :•. '{'•'-,; ''/iviV" ':'•, !:" •: >- ..": • '.'.•':•: ,'
While other root causes presented herein address factors farther upstream in the chain of
„ „ ," , in : .4- ,.,..,, I. •,,,„. . „. i ,„
events leading to the accident, the final possible opportunity to avoid the accident was for
operators to have visually inspected the pneumatically-assisted check valves before the final
compressor startup. In the May 1991 check valve malfunction event at OP-HI, operators visually
detected the partial ejection of the drive shaft from the third stage discharge check valve in time to
take action to prevent complete blow-out of the drive shaft. This was also true in the 1980 and
1994 events at Shells Norco, LA facility. In the 1997 accident, it was likely that the drive shaft
fropi the fifth stage suction check valve had become unrestrained (i.e., the dowel pin had fractured
and the shaft key had fallen out) during one of the several check valve closures mat occurred
earlier that morning. Consequently, it is possible, and in consideration of past events perhaps
even likely, that if operators had visually inspected the position of the check valves immediately
prior to the final compressor startup attempt on the morning of June 22, they might have observed
indications of the PGC fifth stage suction check valve's imminent shaft blow-out and taken
actions to prevent the accident.
Contributing Factors
1) No Indication of Hydrocarbon Leak/Delayed Operator Response to Leak
The lack of clear and immediate indications in the control room of a hydrocarbon leak
contributed to the severity of the accident by significantly delaying operator action to shut down
and depressurize the process gas compression system. This is another aspect of inadequate
process hazards analysis, but is addressed in detail here due to the large role it played in the
release. " . "'' '' .' ',„,'„ ' , ,, :'
,• •: i ,, . .'ji " ! • - i ' , * , r;,1 , ' , . ; •, • ' , r '.'/'" , , .
Once operators were aware that a large process gas leak had occurred, they immediately
(and correctly) acted to shut down and depressurize the PGC system. However, if these actions
had occurred immediately after the gas release began, rather than approximately four minutes
later, the vapor cloud explosion would likely have been either averted entirely or of much smaller
magnitude. Each rninute that the leak continued with the PGC running at full speed contributed
nearly two tons of additional flammable gas to the vapor cloud, substantially increasing the
likelihood and force of the subsequent explosion. In Loss Prevention in the Process Industries
(Lees, 1996), the author cites an analysis conducted by Trevor Kletz (1977) which concludes that
small hydrocarbon vapor clouds, even if they ignite, are not likely to explode. Kletz states:
"... the probability of an explosion certainly appears to be much less if the quantity is
small. ... if there are 10 tons of vapour (sic), the probability of explosion is at least 1 in
10, whereas if there is 1 ton or less, the probability of explosion is of the order of 1 in 100,
or, more likely, one in 1,000."
36
-------
The main reason for the four minute delay in responding to the leak was that control room
operators were unaware that a flammable gas leak had occurred. Various operator statements
conveyed their initial belief that the accident was either a fire or a high-pressure steam leak, and
not a flammable process gas leak. Since the rate of leakage from the PGG system was too small.
to be easily differentiated from the normal process gas flow rates indicated on control room
instruments, and no other indications of flammable gas leakage were available in the control room,
operators there decided to wait for verbal reports from on-scene personnel before taking action.
If flammable gas detection equipment had been installed in OP-HI and monitored in the
control room, operators would have immediately recognized the nature of the accident and would
likely have taken actions to mitigate or prevent the subsequent vapor cloud explosion. Flammable
gas detectors are commercially available today that are intrinsically safe (i.e, they do not present
an ignition or explosion hazard), such as ultraviolet or infrared optical point and open-path
hydrocarbon gas detectors. It is even possible to link such detectors directly to emergency
shutdown systems. . \
In light of the continuing difficulties associated with the PGC in the hours preceding the
accident, it is possible that once the machine had (apparently) successfully been started, operators
were reluctant to shut it down without clear indications of a serious malfunction. Nevertheless,
the JCAIT noted that the strategy of control room operators to take no action without definite
indications as to the nature of the accident was not appropriate. In this case, the worst accident
scenario potentially indicated by the leak in the pipe rack was a vapor cloud explosion resulting
from a process gas leak (a fact that should have been particularly evident since the PGC system
had just been started), and operators should have immediately shut down and depressurized the
PGC system to prevent or mitigate this accident. The adverse safety consequences associated
with taking these actions immediately were minimal, but the consequences of not taking them
immediately were, severe. .
2) Inadequate Communications Practices ••-';•
Inadequate communications practices during the accident contributed to its severity by
hindering the timely flow of information to control room operators. This caused confusion among
control room operators regarding the circumstances of the accident, unnecessarily placed
additional operators in jeopardy from the impending explosion, and further delayed mitigating
actions by control room operators.
Control room operators and operators in the field stated that they had difficulty
understanding radio transmissions from the cold-side foreman due to the excited nature of his
reports and the high background noise in the area of the leak. The cold-side foreman, in turn,
stated that control room operators failed to acknowledge several of his emergency reports and
orders during the gas leak. Various control room operators also stated that they were unsure of
the exact meaning of the foreman's reports and orders. Uncertainties resulting from these
difficulties in communication prompted control room operators to discuss among themselves their
37
-------
understanding of various reports and orders. This, (along with the lack of clear flammable gas
leak indications), contributed to delays in mitigating action.
The confusion in the control room also led five employees to leave the shelter of the
control room and place themselves in great danger because they did not understand the nature-of
the hazard. These employees, as well as the foreman and PGC field operator, were fortunate in
that they did not suffer any indirect effects of the explosion (e.g., impact of indirect fragments,
structural collapse, or blunt object trauma).
Recommendations ' , , ' '.'..,, ..'.,'. ',"., ',.,
The JCAIT developed recommendations addressing the root and contributing causes of
the accident to prevent a recurrence or similar event at this and other facilities. The scope of
these recommendations ranges from general to very specific, and companies and industry groups
not specifically named should consider each recommendation in the context of their own
circumstances, and implement them as appropriate. The recommendations are as follows:
1) Prior to re-starting OP-EX, Shell Chemical Company should replace all Clow Model GMZ
check valves installed in the unit with valves not susceptible to shaft blow-out. If immediate valve
replacement is impossible or impractical, Shell should immediately modify the valves to prevent
shaft blow-out. Other Shell facilities and other companies as appropriate should review their
process systems to determine if they have valves installed that may be subject to this hazard, and
modify or replace those valves as necessary to prevent shaft blow-out. Companies should consult
valve manufacturers or other appropriate design authorities to ensure any modifications made are
safe, [Editor's note: Prior to this report being published, Shell Chemical Company replaced ah"
Clow Model GMZ check valves installed hi QP-III with valves not susceptible to shaft blow-out.]
2) Shell Chemical Company should update and revalidate the process hazards analysis (PHA) at
OP-III and should consider updating and revalidating other units' PHAs to ensure all operating
and maintenance experience and incidents are fully evaluated. Shell should also take appropriate
measures to mitigate hazards identified by the revalidated PHAs.
3) Shell Chemical Company should revise OP-HI process gas compression system operating
procedures to provide clear instructions for operators to re-verify the positions of pneumatically-
assisted check valves before the process gas compressor is re-started following any compressor
trip if said check valves are at high risk of leakage or failure. Shell should also consider adding
warnings or caution statements in process gas compression system procedures related to the
circumstances and indications of check valve shaft blow-out, or other potential causes of
hydrocarbon gas leaks.
4) Shell Chemical Company should improve their radio communications practices at OP-III and
as appropriate at other facilities to ensure operational and emergency information is transmitted in
an accurate and timely fashion. Shell should consider instituting communication verification
1 '.-'; • ' ;> :/38" ' ' '
-------
measures such as mandatory repeat-backs for all operational reports and orders, and should
consider obtaining communications equipment capable of being used effectively in high-noise
environments. Other companies that require operators to communicate in high-noise
environments should also consider talcing these or similar measures.
5) Shell Chemical Company should implement a more rigorous mechanical integrity inspection
program for valves in extreme service or with a known history of failure where the failure of such
valves could result in catastrophic consequences. Where possible, these inspections should
include detailed examinations of critical internal components for damage or failure. Where
indicated by inspections or operating history, additional measures should be taken to maintain
valve integrity. Such measures may include periodic replacement of critical internal components
(e.g., dowel pins), material substitution for critical internal components, installation of shaft or
stem retention devices, complete valve substitution, or periodic valve replacement.
6) Shell Chemical Company and Shell Oil Company should develop and implement a corporate
information communication system, or improve existing systems, to ensure that lessons learned
from all prior operating and maintenance accidents, incidents, and near misses at Shell facilities
(including facilities partly owned by Shell) are always fully reviewed and incorporated as
appropriate into the management and operation of every Shell facility (not just the facility where
the incident occurs).
7) Shell Chemical Company and other companies that process flammable gases and volatile
flammable liquids or liquefied gases must implement precautionary measures contained in
OSHA's PSM standard and EPA's RMP rule to prevent flammable gas leaks from resulting in
vapor cloud explosions. These measures may include the following (other measures than these
may also be advisable, depending on each facility's particular risk factors):
• Installing hydrocarbon or flammable gas detectors which provide immediate and positive
leak indication to field and/or control room operators;
• Installing active vapor cloud suppression equipment in high-risk plant areas; and,
• Conducting process operational drills which train operators to quickly recognize and take
immediate actions to prevent worst-case accidents such as vapor cloud explosions. In
some cases, operators should be trained to immediately act even when presented with
ambiguous accident indications. For example, in a situation where operators are unable to
immediately determine whether a loud and unexpected gas leak in a system is steam or
hydrocarbon gas, they would be trained to immediately take at least the appropriate
actions for a hydrocarbon gas leak if it constitutes the most potentially severe accident.
Readers should understand that this is not intended to encourage companies to take
reckless actions or to perform uncontrolled or emergency shutdowns "at the drop of a
hat". The JCAIT recognizes that in some circumstances, emergency shutdowns can have
adverse consequences and are therefore not to be undertaken lightly. Each facility must
39
-------
evaluate their own circumstances and prepare and implement emergency procedures,
including emergency shutdown procedures, which account for those circumstances.
However, when the adverse consequences of taking emergency shutdown actions are
minimal in relation to the risk of not taking those actions (as was true in this case), such
actions should be taken without delay.
;,: ; • \ • •• xit • • • , s- ,; .'• ••,•..« . >,..••,.,•. , , , ••
8) Atwood & Morrill Co., Inc. (the successor to Clow Corporation of Westmont, Illinois),
should inform all customers who have previously purchased Clow Model GMZ check valves of
the circumstances of this accident and of the potential for these valves to undergo shaft blow-out.
9) Where feasible, companies should consider inherently safer design alternatives. For example,
process designs that reduce or eliminate extreme equipment cycles such as check valve slamming
should be considered, as well as designs which eliminate the possibility or minimize the potential
consequences of worst-case accidents such as vapor cloud explosions.
10) The American Petroleum Institute, the National Petroleum Refineries Association, the
Chemical Manufacturers Association, and other related industry trade associations in the U.S. and
abroad should inform member companies of the circumstances in the EPA/OSHA joint report of
the Shell Deer Park accident.
11) Chemical and petroleum industry trade associations and individual member companies should
work together to develop and institutionalize a stronger system, or improve existing systems, for
sharing and implementing lessons learned from process incidents and accidents at companies in
the United States and abroad.
12) EPA should take appropriate follow-up actions, such as inspections, audits, or
implementation of other policies to ensure that U.S. companies modify, remove, or replace, as
appropriate, all Clow Model GMZ check valves that are at high risk for shaft blow-out.
13) EPA and OSHA should distribute mis report and the Chemical Safety Alert entitled "Shaft
Blow-Out of Chec|: and Butterfly Valves" to affected companies (including valve manufacturers
and users), industry trade associations, Local Emergency Planning Committees (LEPCs), and
State Emergency Response Commissions (SERCs). The Alert counsels process facilities,
including chemical, petrochemical, power generation, compressed gas, and others to review their
prdcess systems to identify valves which may be susceptible to shaft blow-out and, in consultation
With valve manufacturers, replace or modify those valves as necessary to prevent an accident.
EPA and OSHA should also distribute this report to international organizations such as the
Organization for Economic Cooperation and Development (OECD) and the United Nations
Environment Programme (UNEP) so that these organizations may inform member countries of
the circumstances of this accident. Valve manufacturers should consider the risk factors described
in the alert and this report and modify current valve designs as appropriate to prevent shaft blow-
out accidents. [Editor's note: Prior to publishing this report, EPA and OSHA distributed the
subject Alert to affected companies, trade associations, LEPCs, and SERCs, and posted the Alert
40
-------
on the Internet at www.epa.gov/ceppo/. The Alert is also included as Appendix F to this report.]
41
-------
References
' if; i , i •'•.••'••.' .'.'•' " ''. , ' : • ' ,
Engineers, Center for Chemical Process Safety, Guidelines for Evaluating the Characteristics of
Vapor Cloud Explosions, Flash Fires, andBLEVEs, American Institute of Chemical Engineers,
1994 _ . ;;; . . . /..., _;.;;;; '•'••,'-,..',-.."•-.'>
Engineers, Center for Chemical Process Safety, Guidelines for Investigating Chemical Process
Incidents, American Institute of Chemical Engineers, 1992
Federal Emergency Management Agency, U.S. Department of Transportation, U.S.
Environmental Protection Agency, Automated Resource for Chemical Hazard Incident
Evaluation (ARCHIE) Computer Model, 1989.
Fletcher, E.R., Richmond, D., and Yelyerton, J., Glass Fragment Hazard from Windows Broken
by Airblast, Report Prepared for Defense Nuclear Agency, May 30, 1980.
Kletz, T.A., What Went Wrong? Case Histories of Process Plant Disasters, Third Edition, Gulf
Publishing Company^ Houston, TX, 1994
Lees, Frank P., Loss Prevention in the Process Industries: Hazard Assessment, Identification,
and Control, 2nd edition, Butterworth and Heinemann Publishing, 1996
Lloyd, A., Protect Your Plant -with Fire and Gas Detectors, Chemical Engineering Progress,
October, 1996, pp 74-78.
Mercx, W.P.M. and yan den Berg, AC., "Vapor Cloud Explosions," Methods for the Calculation
of Physical Effects, The Netherlands Organization of Applied Scientific Research, 3rd Ed., Vol.
2, Chapter 5, The Hague, 1997.
Technica International Ltd., World Bank Hazard Analysis (WHAZAN) Computer Model, 1988.
U.S. Environmental Protection Agency, Flammable Gases and Liquids and Their Hazards, EPA
744-R-94-002, February 1994.
U.S. Environmental Protection Agency, RMP Offsite Consequence Analysis Guidance, May 24,
1996.
U.S. Environmental Protection Agency, Workbook of Screening Techniques for Assessing
Impacts of Toxic Air Pollutants, EPA-450/4-88-009, September, 1988
van (fen Bosch, C J.H., and Duijm, N. J., "Outflow and Spray Release", Methods for the
Calculation of Physical Effects, The Netherlands Organization of Applied Scientific Research,
3rd Ed., Vol. 2, Chapter 2, The Hague, 1997.
''.''• , ;';:" :;;!V' 42 ' '' ' ' '.' "' ' '
-------
List of JCAIT Members
Name / Organization
James Belke / EPA Headquarters
Mark Briggs / OSHA Houston South Area Office
Kevin Rockwell / OSHA Houston South Area Office
Kim Nguyen / OSHA Houston South Area Office
Russ Elveston / OSHA Houston South Area Office
Craig Weber / OSHA Corpus Christi Area Office
Richard Watson / OSHA Little Rock Area Office
Mike Marshall / OSHA Headquarters
Steve Mason / EPA Region 6
Jack Stark / EPA Region 6
Position
JCAIT Co-leader
JCAIT Co-leader
JCAIT Lead Investigator
JCAIT Investigator
JCAIT Investigator
JCAIT Investigator
JCAIT Investigator
JCAIT Investigator
*.
JCAIT Investigator
JCAIT Investigator
43
-------
Appendix A: OP-HI Layout
!K1
tmmm
mmm
mm -
1
JH
in
i&B m = =" "r "
mm Wind direction 4tlv stage discharge drum
la-snun ; i
HI 5th stage
• suction drum
is:: -> -
I€I *
*» "^.j ^r;
w Check valve
iBinmnnmiBUBiinHi imtmmfWnMWtWWnS
mail ^iMliMriiii MBIIIJ imlinnf IHH MM Mil ini imaiH MmaiB MM HIIIMII Miiinii mm
Elevated pipe racjef
Dilution Stm Gen
Jmmmm
mir
mwi
Pipe alley (passable area i».»',;,: :,..,»<.,,ii«»w«wl«i^*.
underneath elevated pipe rack)
!MW IWITMrMMTBBTMIITMirTagrMBgJBr*---* —**rr *Jn ^ mm m~.m" ^' m* *1*^' wl •• •
mmmmmmmmmiSM
im
f S(8 ffiB!%f
Fractionator
N. 22nd Street
N. 19th Street
I 90 feet
Pyrolysis Furnaces
: 44
-------
Appendix B
Process Gas Compression System - Simplified Flow Diagram5
Hydrocarbon Gas
Liquid Knockout Drums
Pyrolysis
Fractionator
5th stage
suction
check valve
Compressor Stages
* Diagram shows only selected components in main flow path. Subsystems and other components, including low &
high pressure stripping systems, refiigeration system, discharge coolers, condensate pumps, feed heaters, gas dryers,
etc.. are not shown.
45
-------
Appendix C: Events and Causal Factors Chart
Legend: Event [ |
Condition or ^~'
causalfactor
) Inddent S~\
6/22/97 02:15 a.m.
~ 05:30 a.iu.
-05:30-08:45 a,m. ~08:45'-Q9:30a.m. ~ 09:30 ajn
~ 09:45 a.m.
• 10:00 a.tn.
Plant lost power,
OP-m systems
shut down, incL
PGC system.
PGC started on
PGC tripped ftom
Operators place
PGC back on
slow roll and
perform pre-
Btarhm checks
PGC taps due to
3 to 5 times while
high vibration at
operator restarts
on slow roll; re-
PGC and raises
Air-assisted
check valves
lam shut
Check valve
position verified
by observing
position of air
iston.
Further pre-
startup checks
not done; check
valve positions
t verified
V check valves/
Air-assisted
check valves
5th stage suction
Operators exit CR
Foreman radios
Large
hydrocarbon
gas release
begins
gas leak; radios
and smells vapor
source of leak and
control room and
local alarm lights
operators to S/D
drive shaft blows
to notify outside
orders operators
PGC and dump to
to activate alarm
order three tunes
CR operators
have difficulty
understanding
foreman; he
repeats report.
Drive shaft dowel
Lights not
visible in all
locati
pin had fractured.
CR operators
have difficulty
understanding
Drive shaft dowel
pin had undergone
46
-------
Appendix D: Vapor Cloud Explosion Modeling
The JCAIT carried out analyses to answer the following questions concerning the gas
release and explosion that occurred at Shell on June 22, 1997:
• What weight of gas was released from the failed check valve?
• What fraction of the gas released was involved in the explosion and what was its' TNT
equivalent?
• Would the vapor cloud explosion modeled by these parameters be consistent with
observed effects?
The rate and total quantity of process gas released through the 3.75-inch diameter hole in
the check valve was estimated using the calculation methods and models discussed in section 1
below.
To estimate overpressures that resulted from the Shell explosion, window breakage
observed at Shell was analyzed and compared with the overpressures reported to result in
breakage of windows of similar size and thickness. These estimates are discussed in section 2.
The effects of a vapor cloud explosion resulting from the quantity of released gas
determined in section 1 were estimated using two different models, the TNT-equivalent model
and the multi-energy model. The TNT-equivalent model is a widely used model that relates the
blast effects of an explosion of flammable gas to the blast effects of TNT. The multi-energy
model is more recently developed, and models nodes of explosive atmospheres in a confined
space. These models and modeling results are discussed in sections 3 and 4.
A comparison of the results of vapor cloud explosion modeling described in sections 3 and
4 to the estimated overpressures for the window breakage observed at Shell is discussed in
section 5.
1. Release Rate and Quantity Released
Three methods were used to estimate the rate of release of flammable gas through a hole,
as follows:
• The method developed for RMP Offsite Consequence Analysis Guidance (OCA
Guidance) (May 24, 1996 draft); r
The World Bank Hazard Analysis (WHAZAN) model; and
• The Automated Resource for Chemical Hazard Incident Evaluation (ARCHIE) model.
47
-------
To use these methods, a set of "composite" chemical properties was developed, based on
the properties of the pure'substances making up the chemical mixture that was released at OP-III
and the fraction of each substance in me mixture. For purposes of comparison, the same
calculations were performed assuming that the entire mixture had the properties of ethylene, the
major component of the mixture.
The three methods used to estimate the release rate have the same theoretical basis and
>p , "• . • ' : !v:;ll : •:•: • " " •; ", ; ; , M' ;r.;r"':. •.: >. " ...• >'. • ii;.; ••.•• ••'••> >.t,> : : •;
give similar results. As presented in the OCA Guidance, the equation for an instantaneous
discharge under non-choked flow conditions is:
'\
where: m = Discharge rate, kg/s
Cd = Discharge coefficient
Ah = Opening area, m2
Y = Ratio of specific heats
p0 = Tank pressure, Pascals
P! = Ambient pressure, Pascals
Po = Density^ kg/m3
'-. ; . •, :,ii:(i " • i . • M j ! .',' ', . :• , • '•• • i1 , :•. *.•: " , ' ' .
Under choked flow conditions (maximum flow rate), which would apply in the case of the
release at Shell, the equation becomes:
m =
\
Y+l
For all three, methods, the discharge coefficient was assumed to be 0.8.1 The gas pressure
assumed to be t£e average absolute pressure calculated from the pressure differential across
the hole recorded at the Start of the leak and after four minutes. The temperature was assumed to
be constant at 95 of^pOS K). The release rates determined by these three methods, based on
composite chemical properties, and the quantities estimated to be released in four minutes, are in
good agreement, as shown below. Release rates and quantities calculated using the properties of
ethylene were very similar.
The value of the discharge coefficient is determined by two factors: friction between the gas and the sides of the
opening, and contraction of the gas as it flows into the opening. Various sources cite coefficients for circular orifices ranging
from 0.62 to 0.98. Therefore, 0.8 was chosen as an average coefficient for a circular orifice. The calculated release rate varies
linearly with the value of the discharge coefficient, so other Cj values would result in slightly higher or lower release rates.
:148
-------
Method
OCA Guidance
WHAZAN
ARCHIE
Release Rate
(Pounds per Minute)
3,956
3,661
3,620
Quantity Released
(Pounds)
15,820
14,640
14,480
Based on these results, the vapor cloud was estimated to contain 15,000 pounds of gas. for-
the purposes of TNT-equivalent modeling.
2. Overpressure for Window Breakage
The blast overpressure that will cause windows to break depends on a -number of factors,
including the area of the window, the thickness of the glass, the type of glass, and the orientation
of the window with respect to the blast2. Window breakage is reported by various sources3 for
blast overpressures of about 0.15 psi to 1.0 psi. According to one study, overpressures of 0.09 to
0.9 psi will cause 50 percent window failure for most windows oriented face-on to the blast4.
This study provides a graph (reproduced in Figure D-l) that shows the overpressures that will
cause 50 percent window breakage as a function of pane area for glass of six different thicknesses.
: At the Shell site, one of two windows, 0.59 centimeter (cm) thick, with an area of 1.58
square meters (m2), was broken at a distance of 3,200 feet from the center of the blast. Based on
the graph in Figure D-l, an overpressure of about 0.6 psi was necessary to cause this breakage.
Other data from the explosion site indicate that this overpressure may be an overestimate.
Windows at about 2,950 feet (somewhat closer to the blast), that were 0.32 cm thick (i.e., thinner
than the glass that broke) and 0.9 and 0.6 m2 in area, were not broken by the blast. These
windows faced in the same direction (south) as the windows that failed and had the same general
orientation to the blast. Based ori the graph, these windows would have failed if the overpressure
actually reached 0.6 psi. At an overpressure of 0.3 psi, these windows would not be predicted to
fail, but at overpressures not significantly higher, breakage would be expected; The windows that
broke may have been subject to some factor (e.g., strain on the glass, faulty window frames, etc.)
that caused them to break at an overpressure lower than predicted. Based on limited number of
windows involved, given the fact that some south-facing windows broke and others did not, the
overpressure at a distance of approximately 3,000 feet from the blast center may have been
between 0.3 and 0.6 psi.
E. Royce Fletcher, Donald R. Richmond, and John T. Yelverton, "Glass Fragment Hazard from Windows Broken by
Airblast," Report Prepared for Defense Nuclear Agency, May 30, 1980.
U.S. EPA, Flammable Gases and Liquids and Their Hazards, EPA 744-R-94-002, February 1994.
Fletcher, Richmond, and Yelverton, op. cit. , ' :
49
-------
Likewise, at a distance of about 2,800 feet, some windows failed, while others with the
same thickness and similar areas did not. Figure D-l indicates that side-on windows (west-facing
at Shell) would experience-50 percent failure at about 0.5 psi. Since west-facing windows at Shell
experienced about 17 percent failure, the actual overpressure was probably slightly less than 0.5
psi, because some windows that would be predicted to have failed did not. The overpressure at
2,800 feet could therefore be estimated to be between 0.3 and 0.5 psi.
At less than 500 feet from the center of the blast, 100 percent window breakage was
recorded for windows facing in all directions. Based on the window damage at 2800-3000 feet,
100 percent failure would be expected for windows even farther than 500 feet from the blast
confer, since the pressure wave wasimore intense closer to the blast center. The overpressure that
wdiild cause this amount of damage at a distance of 500 feet likely would be greater than 1 psi,
but there is no way to estimate from available window breakage data alone how much greater it
'' '
3. Vapor Cloud Explosion— TNT Equivalent Model
A TNT equivalent model was used to estimate the results of a vapor cloud explosion
involving the quantity of 15,000 pounds estimated in section 1. The TNT equivalent model
relates the blast effects of the explosion of a cloud of flammable gas to the blast effects of an
equivalent quantity of TNT. Because the entire cloud of flammable gas does not participate in the
explosion (since only a fraction of the cloud contains the necessary fuel-air ratio to support
ignition), a liyiold factor" is applied to estimate the portion of the cloud that explodes. The
quantity in the vapor cloud, the yield factor, and the heat of combustion of the flammable gas
compared to the heat of explosion of TNT are used to estimate the quantity of TNT equivalent to
a. given quantity of flammable gas. Empirical relationships derived for TNT explosions are then
used to determine overpressures and distances from a blast involving the flammable vapor cloud.
For mis analysis, a composite heat of combustion was estimated from the heats of combustion of
individual gas components and several different yield factors were assumed for the explosion.
Yield factors for vapor cloud explosions are reported to range commonly from 1 percent
to 10 percent, but may be much higher in some cases. In this case, a relatively high yield factor is
appropriate for a number of reasons, including the following:
• The vapor cloud contained a large amount of hydrogen (approximately 19% by volume),
• The vapor was released as a high-velocity jet, and,
• The vapor was released into a highly congested area (the pipe rack).
Vapor clouds of hydrogen and hydrogen-rich hydrocarbon mixtures have higher
flammable ranges and higher laminar flame speeds, both of which tend to increase the vapor cloud
yield factor. The last two factors caused a large amount of turbulence and high confinement in
the exploding vapor cloud, resulting in higher flame front acceleration and therefore higher
explosive yield factor. Based on these, a high yield factor is appropriate, and this analysis
::;'• ' ' •'. • '""':' / •'/ ; :v ",. 50 ' '' .. . , ., ',.' "' .
-------
estimates distances for various yield factors of 3 to 20 percent to provide a range for comparison
with the results of the overpressure analysis discussed in the previous section.
, Results of TNT-equivalent modeling are presented in the table below. To allow
comparison of the results of TNT-equivalent modeling with the results reported for window
breakage at Shell, the table shows distances to overpressures of 0.15 to 1.0 psi. Overpressures in
this range are reported to result in window breakage, as noted in the previous section. Yield
factors of 0.03, 0.1,0.15, and 0.2 were assumed in order to provide a reasonable range.
The release quantities calculated by the three methods discussed above were used as the
quantity of gas in the vapor cloud.
Quantity
in Cloud
Obs)
15,000
Yield
Factor
0.2
0.15
0.1
0.03
Distance (feet) to Overpressure
0.15 psi
6,360
5,780
5,050
3,380
0.2 psi
4,610
4,190
3,660
2,450
0.3 psi
2,470
2,240
1,960
1,310
0.4 psi
2,230
2,020
1,770
1,180
0.5 psi
1,830
1,660
1,450
970
0.6 psi
1,670
1,520
1,330
890
1.0 psi
1,350
1,230
1,070
720
The results shown in the table for the yield factor of 0.2 agree jbetter than the results for
the lower yield factors with the overpressure previously estimated for glass breakage at Shell. For
all four yield factors, the overpressure at about 500 feet from the blast, where all the windows
failed in the blast at Shell, is greater than 1 psi, which is consistent with 100 percent window
breakage. Based on glass thickness and area, estimated overpressures were from 0.3 to 0.6 psi at
about 2,800 to 3,200 feet, as discussed in the previous section. The results for a yield factor of
0.2 show an overpressure of 0.3 psi at a distance of about 2,500 feet, which is close to the
distance of 2,800 where an overpressure of between 0.3 and 0.5 psi was estimated. The results for
the yield factor of 0.2 and overpressure of 0.15 also indicate that windows could have been
broken at distances of more than a mile from the Shell site. Windows in private residences were,
in fact, broken at various distances more than 1 mile from the blast center, so this is consistent
with the yield factor of 0.2.
4. Vapor Cloud Explosion — Multi-Energy Model
The multi-energy model presented in Methods for the Calculation of Physical Effects
Resulting from Releases of Hazardous Materials was used to carry out calculations of the effects
of a vapor cloud explosion, based on the characteristics of the portion of OP-III where the vapor
cloud formed. The multi-energy model for vapor cloud explosions does not consider the total
quantity of flammable substance in the vapor cloud. Instead, it takes into account the
51
-------
characteristics of the area into which a flammable vapor is released. In particular, it considers
portions of the area where a strong blast could occur, such as congested and obstructed regions,
and only considers the quantity of flammable gas/air mixture that could be found in these regions.
Th4 volume of sucl]i regions and the combustion energy of stoichiometric fuel-air mixtures within
these regions are used in calculating the effects of a vapor cloud explosion. A "blast class" must
be assigned, based on the ignition energy, the degree of obstruction, and the presence or absence
Of parallel plane confinement. A factor is derived for any chosen distance, based on the distance,
the combustion energy within the congested region, and the ambient pressure. Using this factor
and a graph, a scalecf overpressure can be found for the chosen distance and blast class, and the
overpressure at that distance can be estimated.
For the analysis of the Shell explosion, the volume of the congested area was estimated to
be |9,550 cubic meters, and a stpichjometric heat of combustion of 3.5 million Joules per cubic
meter (a value applicable to most hydrocarbon mixtures) was used. For low ignition energy .
(which would apply to the hot surfaces which served as likely ignition sources at Shell) and high
obstruction, the blast class would fall into the range of 3 to 7. The degree of parallel plane
,' ''.if''! ,i • " '" i,,'hi'!'!!!iilill. " i' • ' ! ' ,. ' '!."!,,' • I1 ' i» » ,'' 'i1 •": , I "li1"' M , i >, ,,!•' ,.• i • ' i,,, " ,,'r' i' : .
confinement also affects the blast class. Since detailed information about parallel plane
confinement was np| collected but the degree of confinement was qualitatively estimated to be
quite high (based on the high density of parallel structures in the pipe rack where the vapor cloud
formed), it was conservatively assumed that a blast class of 7 was appropriate for the analysis.
11 - )|!1 , - , ':„• • r .-' 'T,,:1'1.. . ."' i - ii, ;.-,' , i '•• . ''' .. i* :"'
The analysis was conducted for distances of 500 to 5,000 feet, including 2,800 feet and
3,200 feet, distances at which less than 100 percent glass breakage occurred at Shell. Results of
the multi-energy analysis using a blast class of 7 are shown in the table below. (Blast classes of 6
and 7 gave the same result, so the table lists blast classes 6-7.) Cloud volume for this analysis was
Blast Class
6-7
Distance
(feet)
500
1,000
2,000
2,800
3,200
5,000
Overpressure
(psi)
2.9
1.1
0.5
0.32
0.26
0.17
assumed to be 19,550 cubic meters (equivalent to the estimated volume of the congested region),
and total cloud energy was calculated as 68,430 million Joules, based on the cloud volume and the
stoichiometric heat of combustion.
52
,:JJS ' ,f ' K ill.,.' 'lit
-------
At 2,800 to 3,200 feet from the center of the blast, the multi-energy model predicts an
overpressure of about 0.3 (0.32-0.26) psi, which is consistent with the overpressure of 0.3 to 0.6
that we estimated at these distances based on the glass breakage observed at Shell. This result is
also consistent with the TNT-equivalent modeling results assuming a yield factor of 0.2. At 1,000
feet or less from the center of the blast, the multi-energy model predicts overpressures greater
than 1 psi. Again, this result is consistent with the. 100 percent glass failure reported at Shell at
about 500 feet.
5. Comparison of Vapor Cloud Explosion Modeling Results with Blast Effects at Shell
An overpressure of 0.3 psi at about 2,500 to 3,200 feet is predicted by both the TNT-
equivalent model (assuming a yield factor of 0.2) and the multi-energy model (assuming^ a blast
class.of 6-7). This overpressure is consistent with the overpressure of 0.3 to 0.6 psi that was
estimated for the 50 percent glass breakage recorded at Shell at approximately 3,000 feet, as
discussed earlier. These modeling results are in agreement with the lower end of the estimated ,
overpressure range, when conservative assumptions were used regarding the yield factor for
TNT-equivalent modeling and the blast class for multi-energy modeling. Larger releases (for the
TNT-equivalent model) and larger cloud volumes (for the multi-energy model) also would give
results that would fall into the estimated overpressure range for the observed effects.
Based on the results of the foregoing release rate and vapor cloud explosion modeling, the
questions posed at the beginning of this analysis can reasonably be answered as follows:
• The release of about, 15,000 pounds of gas is consistent with the blast effects observed at
Shell.
• About 3,000 pounds of gas was involved in the explosion (for a yield factor of 0.2), which
was equivalent to about 31,000 pounds of TNT.
• A vapor cloud containing about 15,000 pounds, rapidly released into a highly congested
area with a volume of about 20,000 cubic meters, could generate overpressures sufficient '
to produce the effects observed at Shell.
53
-------
. p
I"':
t"
0.3161 Double \
^Strength]
FO: Face-On Orientation
SO: Side -On Orientation
;to
PEAK OVERPRES SURE ON Wtr Oo FOR 50%
PROBABiLITY OF FAI LURE. kPa
• • . ';'••• ; • :• ;;;•• • •• Figure D-l
Peak Blast-Wave Overpressure on a Window for 50-Percent Probability of Failure
Source: E, Royce FletcSerj Donald R. Ricnmond, and John t. Yelverton, "Glass Fragment Hazard from Windows
Broken by AkblasV'Report Prepared for Defense Nuclear Agency, May 30,1980^
I1,'!!
-------
Appendix E: Photographs of Shell Chemical Company OP-III Unit Damage
55
-------
-------
Figure E-1: Photograph of the damage resulting from the explosion and fire at Shell Olefins Plant
Number 3 (view from west of blast area). Note the heavy structural damage in the rear center of
the photograph.
Figure E-2: Close-up of OP-III damage. The structure supporting the overhead cooling fans
melted due to the intense heat of the fire and collapsed on top of the pipe rack.
57
-------
Figure E-3: Photograph of explosion and fire damage at OP-III as seen from the north side of the
blast zone.
Figure E-4: Photograph of explosion and fire damage at OP-III as seen from norfli side of pipe
rack, looking upward.
58
-------
Figure E-5: Photograph looking down pipe alley (passable area underneath pipe rack) where
explosion occurred.
Figure E-6: Photograph of explosion and fire damage in the area of the PGC fifth stage suction "
and discharge drums (viewed from the north). The man in the lower center provides a reference
to the scale of the surrounding structures. The failed check valve was located behind the drum to
the man's right.
59
-------
Figure E-7: Photograph of blast damage to buildings and structures in the vicinity of the
explosion. Note the budded metal walls of the storage building in the center and the panels
missing from the cooling tower on the right These buildings were located approximately 500 feet
north of the blast center.
if»
Vip H i(j t is*, u JH i ,y r' "" *
Figure E-8: Photograph of damage to a
pickup truck parked near the blast site.
Most automobiles parked in this company
lot during the accident suffered damage.
60
-------
Figures E-9 and E-10: Photographs of two views of the disassembled subject 36" Clow check
valve. The pneumatic actuator assembly can be seen in both views. In the lower photograph, the
hole directly below the 12-inch ruler formerly contained the valve's drive shaft. This is where the
shaft blow-out and flammable gas release occurred.
61
-------
Figure E-l 1: Photograph shows the drive
shaft and counterweight that were ejected
from the 36" Clow check valve.
Figure E-12: Photograph shows the head of the machine screw protruding from the portion of
the fractured pin. The pin is shown extended slightly out from the surface of the flange, or disk
"ear", from which the valve shaft was ejected.
62
-------
Figure E-13: Photograph shows the metal key intended to help mechanically connect the drive
shaft to the valve disk.
Figure E-14: Photograph depicts the
measured looseness of the key within
its machined slot, or keyway. The
key was intended to transfer torque
between the shaft and the valve disk,
but the key's loose fit forced the
much smaller dowel pin to transfer
virtually all drive shaft torque. The ,
key eventually fell out of its slot as
the drive shaft moved outward after
the dowel pin fractured.
63
-------
Figure E-l5:
Photograph shows the
general configuration
of the intact dowel phi
removed from the
idler shaft, and a
portion of the
fractured pin. Both
pins exhibit the
threaded machine
screws, which were
placed in hoies drilled
in the center of each
pin to allow later pin
removal.
Figure E-l 6:
Perspective view of
the fractured dowel
pin showing the
fracture face
extending through the
drilled hole within the
center of the pin.
64
-------
Figure E-17: Views of the longitudinal and transverse cross-sections taken through the intact
dowel pin showing the carburized case at both the outside diameter of the pin and within the
drilled hole.
Figure E-18: 25X magnification fractograph displaying a portion of the fracture face of the dowel
pin which broke in the service of the 36" Clow check valve.
65
-------
Figure E-19:100X magnification scanning
electron microscope (SEM) fractograph
depicting the intergranular fracture at the
carburized surface of the dowel pin.
Figure E-20:400X magnification SEM
fraetograph of the dowel pin shows
details of the intergranular "rock
candy"fracrure surface at the outside
diameter of the dovyel pin, a characteristic
of hydrogen embritflement failure mode.
-------
Figure E-21: A view of pipe section X-8878, one of four pipe sections removed from OP-III in
addition to the Clow check valve for laboratory analysis as possible sources of the initial
flammable gas leak.
Figure E-22: At higher magnification, this macrograph shows the high temperature oxidation and
fire damage around the opening in the pipe section. Laboratory analysis of this and each of the
other three pipe sections revealed similar fire-induced failure modes, indicating that none were the
likely source of the initial flammable gas leak. ,
67
-------
68
-------
Appendix F:
EPA/OSHA Chemical Safety Alert
"Shaft Blow-Out Hazard of Check and Butterfly Valves"
69
-------
oz.
, I
-------
United States
Environmental Protection
Agency
United States
Occupational Safety and
Health Administration
EPA550-F-97-002F
September 1997
vvEPA
OSHA<0>
SHAFT BLOW-OUT HAZARD OF
CHECK AND BUTTERFLY VALVES
The Environmental Protection Agency (EPA) and Occupational Safety and Health Administration
(OSHA) are issuing this Alert as part of their ongoing efforts to protect human health and the
environment by preventing chemical accidents. Under CERCLA, section 104 (e), the Clean Air
Act (CAA), and the Occupational Safety and Health Act (OSH Act), EPA and OSHA have
authority to conduct chemical accident investigations. Additionally, in January 1995, the
Administration asked EPA and OSHA to jointly undertake investigations to determine the root
cause(s) of chemical accidents and to issue public reports containing recommendations to prevent
similar accidents. EPA and OSHA have created a chemical accident investigation team to work
jointly in these efforts. Prior to the release of a full report, EPA and OSHA intend to publish
Alerts as promptly as possible to increase awareness of possible hazards. Alerts may also be
issued when EPA and OSHA become aware of a significant hazard. It is important that facilities,
SERCs, LEPCs, emergency responders and others review this information and take appropriate
steps to minimize risk.
PROBLEM
Certain types of check and butterfly
valves can undergo shaft-disk
separation, and fail cata-
strophically or "blow-out", causing toxic
and/or flammable gas releases, fires, and
vapor cloud explosions. Such valve
failures can occur eyen when the valves
are operated within their design limits
of pressure and temperature.
ACCIDENT HISTORY
In a 1997 accident, several workers
sustained minor injuries and millions
of dollars of equipment damage
occurred when a pneumatically assisted
Clow stub-shaft Model GMZ check (non-
return) valve in a 300 psig flammable gas
line underwent shaft blow-out. The
valve's failure caused the rapid release
of large amounts of light hydrocarbon
gases which subsequently ignited,
resulting in a large ,vapor cloud
explosion. and fire.
The check valve was designed with a
drive shaft that connects the internal
valve disk to an external pneumatic
cylinder (see diagram on next page). The
valve failed when a dowel pin designed
to fasten the drive shaft to the disk
sheared and a key designed to transfer
torque from the drive shaft to the disk
fell out of its keyway, disconnecting the
drive shaft, from the disk. System
pressure was high enough to eject the
unrestrained drive shaft from the valve,
carrying with it the external
counterweight assembly, weighing over
200 Ibs., a distance of 43 feet away.
The absence of the drive shaft left a hole
in the valve body the diameter of the
shaft (3.75 inches) directly to
atmosphere, and initiated a high-
pressure light hydrocarbon leak. The
leak continued for approximately 2 to 3
minutes, forming a large cloud of
flammable light hydrocarbon vapor. The
vapor cloud ignited, resulting ,in an
explosion felt and heard over 10 miles
away. The explosion and ensuing fire
caused extensive damage to the facility,
completely or partially destroying many
major components, piping systems,
instruments, and electrical systems, and
requiring the complete shut-down of the
affected unit for cleanup and repair.
Minor damage occurred to nearby
residences and automobiles (mostly
broken glass and minor structural
damage due to the blast wave). Nearby
highways were closed for several hours.
Damage cost to the facility alone is
estimated at approximately 90 million
dollars. Fortunately, no fatalities and
only minor injuries to workers resulted
from the accident.
EPA and OSHA
> Printed on recycled paper
-------
Shaft Blow-Out Hazard of Check and Butterfly Valves
September 1997
Previous malfunctions involving check valves
of the same or similar design occurred at
facilities in 1980, 1991, and 1994. In each case,
the affected check valve was located in a large
diameter (36-inch or greater) pipe in a
hydrocarbon gas compression system. Also in
each previous case, a dowel pin fastening the
valve*!,: drive shaft to fedisk sheared (m the 1980
case the pin was possibly never installed) and a
rectangular key fell out of its keyway,
disconnecting the drive shaft from the disk.
Although shaft-disk separation occurred in each
previous case, it did not result in shaft blow-out
or catastrophic failure. This may be because the
valves in these instances were installed in lower-
pressure service, or because the malfunctioning
valves were identified before shaft blow-out
occurred.
In the 1991 incident, the malfunction was
manifested by the erratic operation of the valve,
which was observed to operate independently
from its external drive mechanism. System
pressure was low enough (70 psig) that the
failure was detected before the shaft was
expelled out of the valve body. (At the time the
malfunctioning valve was identified, the valve
shaft was protruding about 0.75 inches out of
the valve body.) In the 1980 and 1994 cases, the
malfunction was identified when workers noted
that the external piston rod connecting the air-
assist cylinder to the drive shaft had broken due
to axial movement of the drive shaft.
HAZARD AWARENESS
Check and butterfly valves are used in
many industries, including refineries,
petrochemical plants, chemical plants,
power generation facilities, and others. Most
modern valve designs incorporate features that
reduce or eliminate the possibility of shaft blow-
out. However, older design check and butterfly
Valves with external appendages such as
pneumatic-cylinders, counterweights, manual
operators, or dashpots may be subject to this
hazard. Shaft blow-out may be of particular
concern wherever these valves are installed in
systems containing chemicals leading to
hydrogen embrittlement.
Valves subject to this hazard may be designed
with a two-piece valve stem (sometimes referred
to as a "stub-shaft" design). In each of the cases
described above, the malfunctioning component
was a Clow stub-shaft Model GMZ
pneumatically assisted swing check valve (see
diagram below). In these check valves, one stem
piece functions as a drive shaft that connects the
internal valve disk to an external air-assist
cylinder and counterweight assembly. The drive
shaft penetrates the pressure boundary through
a stuffing box. The exterior portion of the drive
Simplified cross-sectional view of check valve (flow direction is into page)
Counterweight
Area of Failure
Dowel Pins
Shaft Rotation
Shaft ! Shaft Key/Keyway
' '
Direction of Blowout
Valve Disc (flapper
shown in open position)
Air-assist cylinder
-------
Shaft Blow-Out Hazard of Check and Butterfly Valves
September 1997
shaft is connected to a pneumatic piston and
counterweight, and the interior portion of the
shaft is coupled directly to the valve disk using
a cylindrical hardened steel dowel pin and a
rectangular bar key. This arrangement provides
a power-assist to close the valve during
compressor shut down, preventing reverse flow
of compressed gases. These particular valves
have probably not been produced since 1985, but
still exist in some process facilities constructed
before that date. Similar, valves currently or
previously produced and sold by other valve
manufacturers may also be subject to this
hazard.
Factors in Valve Failure
A number of design and operational factors may
contribute to this hazard. These include the
following: -
Design Factors
+ The valve has a shaft or stem piece which
penetrates the pressure boundary and ends
inside the pressurized portion of the valve.
This feature, results in an unbalanced axial
thrust on the shaft which tends to force it (if
unconstrained) out of the valve.
+ The valve contains potential internal failure
points, such as shaft dowel-pins, keys, or bolts
such that shaft-disk separation can occur
inside -the valve.
Oerational Factors
dimensions and manufacturing
tolerances of critical internal parts (e.g., keys,
'keyways, pins, and pin holes) as designed or
as fabricated cause these parts to carry
abnormally high loads (e.g., in the 1997
accident, the dowel pin rather than the key
transmitted torque from the shaft to the disk).
valve stem or shaft is not blow-out
resistant. Non blow-out resistant design
features may include two-piece valve stems
that penetrate the pressure boundary
(resulting in a differential pressure and
unbalanced axial thrust as described above),
single-diameter valve shafts (i.e., a shaft not
having an internal diameter larger than the
diameter of its packing gland) or shafts
without thrust retaining devices, such as split-
ring annular thrust retainers.
valve is subject to high cyclic loads. In
all of the above incidents, the valve repeat-
edly slammed shut with great force during
compressor trips and shutdowns. Such re-
peated high stresses may cause propagation
of intergranular cracks in critical internal com-
ponents, such as dowel pins.
valve is subject to low or unsteady flow
conditions, such that disk flutter or chatter
occur, resulting in increased wear of keys,
dowel pins, or other critical internal
components. . "* '
* Valves in high-pressure service lines may be
more likely to undergo shaft blow-out (in the
1997 accident, system pressure at the failure
point was approximately 300 psig).
^Valves used in hydrogen-rich or hydrogen
sulfide-containing environments may be
more susceptible to blow-out due to hydrogen
embrittlement of critical internal components,
particularly if these are made from hardened
steel (as was the dowel pin in the 1997
accident).
HAZARD ABATEMENT
Facilities should review their process
systems to determine if they have valves
installed that may be subject to this
hazard. If so, facilities should conduct a
detailed hazard analysis to determine the risk
of valve failure. Check valves or butterfly
valves which are subject to several or all of the
above design and operational factors are at
high risk for shaft blow-out. Detailed internal
inspections may be necessary in order to
identify high-risk valves. Facilities should
consider replacing high-risk valves at the
earliest opportunity with a blow-out resistant
design. Several blow-out resistant designs of
check and butterfly valves are available. If
immediate valve replacement is impossible or
impractical, facilities should consider
immediately modifying the valves to prevent
shaft blow-out. Valve manufacturers should
be consulted in order to ensure that any
modifications made are safe.
-------
Shaft Blow-Out Hazard of Check and Butterfly Valves
September 1997
INFORMATION RESOURCES
ON VALVE SAFETY
Some source? of information on valve safety
are listed below,
. '. Tiif't • ,''' I . i j Cii ''•!,'' '•'',! .' . ' '""i""'
'i:l ,' " • :. f ; ' • " • "J
General References
Information op cases Qf valve failure can be found
in T. j|lqtz, What Wen! Wrong?, 3rd Edition^ Gulf
Publishing Co., Houston (1994). This reference
contains general information related to check valve
failure (pp 127, 129, and 175) and cites one specific
case of check valve failure (page 124) similar to
those described in this Alert.
Information on hydrogen embrittlement can be
found in P.P. Lees, Loss Prevention in the Process
Industries: Hazard identification, Assessment, and
Control, 2nd edition, Butterwqrth-Heinemann
Publishing, Oxford (1996), pp 12/82-83.
American Petroleum Institute
1220 L Street NW
Washington, DC 20005
; Phc;ne: (202) 682-8000
Webfsite: http://www.api.org
Relevant API standards include:
API 598-1996 — Valve Inspection and Testing
API 570-1993 — Piping Inspection Code:
Inspection. Repair. Alteration, and Rerating of
In-Service Piping Systems
API 941-1991 — Steels for Hydrogen Service at
Elevated Temperatures and Pressure in
Petroleum Refineries and Petrochemical Plants
Relevant API Recommended Practices include:
RP 574-1992 — Inspection of Piping. Tubing.
Valves and Fittings
RP 591-1993 — User Acceptance of Refinery
Valves
t
Codes, Standards, and
Regulations
Tile American Society of Mechanical Engineers (ASMS)
has a standard/or valves,
American Society of Mechanical Engineers
345 East 47th Street
NY 10017
or
22 Law Drive
Fairfield, NJ 07007-2900
Phone: (800) 843-2763
Web site: http://www.asme.org
'd. ' ' •••."•:• . Mil • i • ' ':,- ;v: : ',•
1 ,;i • , „ , ' •. , i ,|'.'.i''iii!ii ..... ' , " „ ..... ,L ,; ,
t ASME standards include:
E B 1 6.34- 1996 — Valves - Flanged.
Threaded, and Welding End, an American
National Standard.
Tlte American Petroleum. Institute (API) has several
reliant standards and Recommended Practices.
Applicable regulations include:
29 CFR 1910.119 Process Safety Management
of Highly Hazardous Chemicals: Explosives
and Blasting Agents.
FOR MORE INFORMATION...
CONTACT EPA's EMERGENCY PLANNING AND
COMMUNITY RIGHT-TO-KNOW HOTLINE
(80.0) 424-9346 OR (703) 412-9810
TDD (800) 553-7672
MONDAY-FRIDAY, 9 AM TO 6 PM, EASTERN TIME
VISIT THE EPA CEPPO HOME PAGE ON THE
WORLD WIDE WEB AT: '
http://www.epa.gov/swercepp/
VISIT OSHA's HOME PAGE ON THE WORLD WIDE
WEB AT:
http://www.osha.gov/
NOTICE
The statements In this document are intended solely as guidance. This document does not substitute for EPA's, OSHA's, or
othor agency regulations, nor is it a regulation itself. Site-specific application of the guidance may vary depending on process
activities, and may not apply to a given situation. EPA or OSHA may revoke, modify, or suspend this guidance in the future,
as appropriate.
------- |